Evaluate Change Request

Evaluate a change request without saving it by sending an HTTPS POST request to https://graph.prod.firemon.cloud/graphql.

Set the Authorization header to the idToken from Authentication. Evaluating requires the same permission as saving: requesting firewall changes.

How it works

evaluateChangeRequest takes the same input as Save Change Request and runs the same Boundary evaluation, but synchronously and without persisting anything: no change request is created or updated, and nothing appears in Connect. The response contains the verdict directly (state, stateReason, the per-Boundary results, and score), so there is no Pending state to poll.

Use it to check a proposed change before committing to it: as a pre-flight step in a CI/CD pipeline or ticketing workflow, or to validate a request interactively while it's being drafted, which is how the Connect app uses it. The result is the same as saving the request would produce.

Note that evaluateChangeRequest is a query, not a mutation, since it changes nothing.

Example

The input takes the same fields as Save Change Request.

{
  "query": "query evaluateChangeRequest($input: ChangeRequestInput!) { evaluateChangeRequest(input: $input) { state stateReason score results { boundaryAction boundaryId boundaryName isMatch message state } } }",
  "operationName": "evaluateChangeRequest",
  "variables": {
    "input": {
      "id": "",
      "name": "Allow all outbound HTTPS from Lab",
      "projectId": "",
      "rules": [
        {
          "action": "Allow",
          "sources": [{ "type": "Cidr", "cidr": "10.10.10.0/24" }],
          "destinations": [{ "type": "Any" }],
          "services": [{ "type": "TCP", "portStart": 443, "portEnd": 443 }]
        }
      ]
    }
  }
}

An example using cURL:

curl --request POST \
  --url https://graph.prod.firemon.cloud/graphql \
  --header 'Authorization: IdToken' \
  --header 'Content-Type: application/json' \
  --data '{"query":"query evaluateChangeRequest($input: ChangeRequestInput!) { evaluateChangeRequest(input: $input) { state stateReason score results { boundaryAction boundaryId boundaryName isMatch message state } } }","operationName":"evaluateChangeRequest","variables":{"input":{"id":"","name":"Allow all outbound HTTPS from Lab","projectId":"","rules":[{"action":"Allow","sources":[{"type":"Cidr","cidr":"10.10.10.0/24"}],"destinations":[{"type":"Any"}],"services":[{"type":"TCP","portStart":443,"portEnd":443}]}]}}}'

An example response:

{
  "data": {
    "evaluateChangeRequest": {
      "state": "Fail",
      "stateReason": "This request failed the following boundaries:\n* No outbound rules to Any",
      "score": 0,
      "results": [
        {
          "boundaryAction": "Fail",
          "boundaryId": "d0000000-0000-4000-8000-000000000005",
          "boundaryName": "No outbound rules to Any",
          "isMatch": true,
          "message": "Outbound rules must name a specific destination.",
          "state": "Fail"
        }
      ]
    }
  }
}

A Boundary counts toward the verdict only when its isMatch is true. Here the Fail Boundary matched the rule's Any destination, so the request fails. message is the note configured on the Boundary, if any.