Schema

The change request types from the Connect GraphQL schema:

type ChangeRequest {
  id: String!
  parentPath: String!
  projectId: String!
  name: String!
  rules: [ChangeRequestRule!]!
  state: ChangeRequestState!
  stateReason: String
  results: [BoundaryResult!]
  createdAt: String!
  createdBy: String!
  updatedAt: String!
  updatedBy: String!
  score: Int
}

"""
The result of evaluating a Change Request without persisting it.
Returned by evaluateChangeRequest, for interactive evaluation while a request is being edited.
"""
type ChangeRequestEvaluation {
  state: ChangeRequestState!
  stateReason: String
  results: [BoundaryResult!]
  score: Int
}

type BoundaryResult {
  boundaryAction: BoundaryAction!
  boundaryId: String!
  boundaryName: String!
  isMatch: Boolean!
  score: Int
  platforms: [TargetPlatform!]
  state: ChangeRequestState
  message: String
  matchingRuleIds: [String!]
}

type TargetPlatform {
  name: String!
  provider: AccountProvider!
  accountId: String!
}

provider is the target account's provider. Boundaries export to Guardicore and ServiceNow accounts, so a result's platforms carry guardicore or servicenow.

type ChangeRequestRule {
  id: String
  action: FirewallAction!
  sources: [NetworkObject!]!
  sourcesDescription: String
  destinations: [NetworkObject!]!
  destinationsDescription: String
  services: [ServiceObject!]!
  servicesDescription: String

  summary: String
  notes: String
  "Business justification"
  justification: String

  applicationName: String
  applicationOwner: String
  customer: String
  externalTicketIds: String
  "Comma-separated list of email addresses of involved parties"
  emailAddresses: String

  "Reason current access is insufficient"
  reason: String
  existingCompensatingControls: String
  riskOwnerName: String
  riskOwnerEmail: String

  comment: String
  owner: String
  expiration: String
}

enum ChangeRequestState {
  Pass
  Pending
  Fail
  Review
  Error
}

type ChangeRequestPage {
  items: [ChangeRequest!]!
  pageInfo: PageInfo!
}

enum BoundaryAction {
  Pass
  Fail
  Score
}

enum FirewallAction {
  Allow
  Deny
}

type InventoryItemKey {
  accountId: String!
  region: String!
  type: String!
  id: String!
}

enum NetworkObjectType {
  Any
  Cidr
  ConnectGroup
  Internet
  InventoryItem
}

enum NetworkObjectCidrComparison {
  "The boundary CIDR(s) (group, CIDR, item) must be greater than or equal to all of the change request's CIDR(s) (group, CIDR, item)"
  Contains
  "The boundary CIDR(s) (group, CIDR, item) must be strictly equal to all of the change request's CIDR(s) (group, CIDR, item)"
  Equals
}

interface NetworkObject {
  type: NetworkObjectType!
  negate: Boolean
}

type NetworkObjectAny implements NetworkObject {
  type: NetworkObjectType!
  negate: Boolean
}

type NetworkObjectCidr implements NetworkObject {
  type: NetworkObjectType!
  cidr: String!
  comparison: NetworkObjectCidrComparison
  negate: Boolean
}

type NetworkObjectConnectGroup implements NetworkObject {
  type: NetworkObjectType!
  groupId: String!
  comparison: NetworkObjectCidrComparison
  negate: Boolean
}

type NetworkObjectInternet implements NetworkObject {
  type: NetworkObjectType!
  negate: Boolean
}

type NetworkObjectInventoryItem implements NetworkObject {
  type: NetworkObjectType!
  itemKey: InventoryItemKey!
  comparison: NetworkObjectCidrComparison
  negate: Boolean
}

enum ServiceObjectType {
  AllICMPv4
  AllICMPv6
  AllTCP
  AllTraffic
  AllUDP
  CustomProtocol
  ICMPv4
  ICMPv6
  TCP
  UDP
  PortRangeSize
}

interface ServiceObject {
  type: ServiceObjectType!
}

type ServiceObjectBase implements ServiceObject {
  type: ServiceObjectType!
}

type ServiceObjectCustomProtocol implements ServiceObject {
  type: ServiceObjectType!
  protocol: Int!
}

type ServiceObjectIcmpV4 implements ServiceObject {
  type: ServiceObjectType!
  icmpType: Int!
  icmpCode: Int!
}

type ServiceObjectIcmpV6 implements ServiceObject {
  type: ServiceObjectType!
  icmpType: Int!
  icmpCode: Int!
}

type ServiceObjectTcp implements ServiceObject {
  type: ServiceObjectType!
  portStart: Int!
  portEnd: Int!
}

type ServiceObjectUdp implements ServiceObject {
  type: ServiceObjectType!
  portStart: Int!
  portEnd: Int!
}

type ServiceObjectPortRangeSize implements ServiceObject {
  type: ServiceObjectType!
  maxSize: Int!
}

type PageInfo {
  """
  If nextPageKey is null, there are no more pages.
  Otherwise, pass nextPageKey in another request to get the next page.
  """
  nextPageKey: String
}

input ChangeRequestInput {
  id: String!
  name: String!
  projectId: String!
  rules: [ChangeRequestRuleInput!]!
}

input ChangeRequestRuleInput {
  id: String
  action: FirewallAction!
  sources: [NetworkObjectInput!]!
  sourcesDescription: String
  destinations: [NetworkObjectInput!]!
  destinationsDescription: String
  services: [ServiceObjectInput!]!
  servicesDescription: String

  summary: String
  notes: String
  "Business justification"
  justification: String

  applicationName: String
  applicationOwner: String
  customer: String
  externalTicketIds: String
  "Comma-separated list of email addresses of involved parties"
  emailAddresses: String

  "Reason current access is insufficient"
  reason: String
  existingCompensatingControls: String
  riskOwnerName: String
  riskOwnerEmail: String

  comment: String
  owner: String
  expiration: String
}

input InventoryItemKeyInput {
  accountId: String!
  region: String!
  type: String!
  id: String!
}

input NetworkObjectInput {
  type: NetworkObjectType!
  comparison: NetworkObjectCidrComparison
  negate: Boolean
  cidr: String
  groupId: String
  itemKey: InventoryItemKeyInput
}

input ServiceObjectInput {
  type: ServiceObjectType!

  "CustomProtocol"
  protocol: Int

  "ICMPv4 & ICMPv6"
  icmpType: Int
  "ICMPv4 & ICMPv6"
  icmpCode: Int

  "TCP & UDP"
  portStart: Int
  "TCP & UDP"
  portEnd: Int

  "PortRangeSize"
  maxSize: Int
}

type Query {
  "Get a single Change Request by its ID."
  changeRequest(id: String!): ChangeRequest

  "Get a page of Change Requests."
  changeRequests(nextPageKey: String, limit: Int): ChangeRequestPage!

  """
  Evaluate a draft Change Request against boundaries without persisting it.
  Read-only: does not save results, increment boundary use counts, or export to integrations.
  Used for interactive evaluation while a request is being edited.
  """
  evaluateChangeRequest(input: ChangeRequestInput!): ChangeRequestEvaluation!
}

type Mutation {
  "Delete a Change Request by ID. Returns the deleted request's ID."
  deleteChangeRequest(id: String!): String!

  """
  Save a Change Request and start the asynchronous process of evaluation against all enforced Boundaries.
  If ID is specified, and a change request exists with that ID,
  the change request will be updated. Otherwise a new change request will be created.
  """
  saveChangeRequest(input: ChangeRequestInput!): ChangeRequest!
}

Internet is accepted on Boundaries only. A change request that names it is rejected; see The Internet. The Applies when control on a Boundary statement is covered under Any and All.