Inventory API

Query the Inventory that Groups are built from: search items across accounts, look one up, or list the item types Connect knows about.

Set the Authorization header to the idToken from Authentication. Reading inventory requires permission to view inventory.

What an inventory item is

An inventory item is one resource in your network: a cloud resource such as a VM or storage bucket, or an on-prem asset such as an Infoblox network. Each item is identified by its account, region, type, and ID, and carries:

• Network identity: IP addresses and CIDRs (ips), hostname, and MAC address
• Display: a name and a human-readable type (typeName)
• Classification: key/value tags and the vendor it came from
• Detail: the resource's raw attributes as JSON (item), plus activity metadata such as when it was last seen

Items are what the rest of Connect operates on. Group filters match items by tag, type, account, region, or CIDR, and the matching items' addresses become the Group's members, which is what gets exported to your firewalls. Change requests can also name an inventory item directly as a source or destination, using the same account, region, type, and ID key.

Operations

Operation	REST	GraphQL
Search inventory	GET /inventory?query=&sort=&from=&size=	inventoryItemsSearch(query, sort, from, size): InventoryItemSearchPage!
Get one item	POST /inventory/item	inventoryItem(accountId, region, type, id): InventoryItem!
List item types	GET /inventory/type-names	inventoryTypeNames: [InventoryItemType!]!

The search query uses Lucene syntax over the item's top-level fields, or full-text search when no field is named:

• region:"us-west-1" OR region:"us-west-2"
• cloudAccountId:123456789012 AND region:"us-east-1"
• ip:"10.0.0.0/8" matches items with an IP address inside the CIDR

Results are paged with from and size (from: 0, size: 10 for the first page of ten, from: 10 for the second), and the response's pageInfo.total is the number of matches (capped at 10,000). For inventoryItem, accountId is the account's internal UUID, not the cloud account ID.

The REST reference also lists POST /inventory/items and POST /inventory/items/cleanup. Those are used by the Connector to upload discovery results; they authenticate as a registered Connector and aren't available to user tokens.

Examples

Search over REST, using cURL:

curl --request GET -G 'https://api.prod.firemon.cloud/inventory' \
  --header 'Authorization: IdToken' \
  --data-urlencode 'query=ip:"10.0.0.0/8"' \
  --data-urlencode 'size=10'

The same search over GraphQL:

curl --request POST \
  --url https://graph.prod.firemon.cloud/graphql \
  --header 'Authorization: IdToken' \
  --header 'Content-Type: application/json' \
  --data '{"query":"query inventoryItemsSearch($query: String, $from: Int, $size: Int) { inventoryItemsSearch(query: $query, from: $from, size: $size) { pageInfo { total from size } items { accountId region type typeName id name ips } } }","operationName":"inventoryItemsSearch","variables":{"query":"ip:\"10.0.0.0/8\"","from":0,"size":10}}'