update_firewall_policy
update_firewall_policy
Section titled “update_firewall_policy”Change a Zone-Based Firewall policy you created (Integration API).
Side effects:
- Reads the policy, applies the changes, and PUTs the whole policy back, since the v1 PUT replaces it. Takes effect on the next packet.
- Refuses controller-managed policies (predefined or derived return
traffic): only
metadata.origin == "USER_DEFINED"is editable. - Mutates controller state. Use dry_run=True to preview the before and after bodies without applying.
Verified write: after the PUT the policy is re-read and the response
carries it plus a verification block (verified,
persisted_fields, dropped_fields and the rest), the same block
the other update_* tools return. Written through the Integration
API only (ADR 0009).
The named arguments cover the common edits. updates takes any
other top-level v1 field (source, destination,
ipProtocolScope, connectionStateFilter, schedule) in v1
shape, replacing that field whole; it is applied after the named
arguments.
Example
Section titled “Example”update_firewall_policy(policy="Allow IoT to Plex", enabled=False)Parameters
Section titled “Parameters”| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
policy |
string |
yes | — | The policy’s v1 id (from create_firewall_policy) or its exact name. A name shared by two policies is refused. |
name |
string |
no | “” | New name. Empty keeps the current one. |
action |
string |
no | “” | New action: "allow", "block" or "reject". Empty keeps the current one. |
enabled |
`boolean | null` | no | null |
logging |
`boolean | null` | no | null |
description |
`string | null` | no | null |
updates |
`object | null` | no | null |
controller |
string |
no | “default” | Name of the UniFi controller to target. Defaults to "default". |
dry_run |
boolean |
no | false | Preview the before/after bodies without applying. |