---
title: "Patch firewall policy"
method: PATCH
path: "/v1/vms/{id}/firewall"
tags: ["firewall"]
---

# Patch firewall policy

`PATCH /v1/vms/{id}/firewall`

Updates `mode` and/or `ingress` on the firewall policy. Passing
`ingress: []` clears all rules; omitting `ingress` leaves rules
unchanged.

## Request body

- PatchFirewallRequest — Partial firewall update. Both fields are optional. `ingress: []` clears all rules; omitting `ingress` leaves the existing rules unchanged. An empty body (`{}`) is accepted as a no-op re-normalize.
  - `mode` string — Firewall mode. Known values: `open` (allow all inbound traffic), `restricted` (deny by default; only rules listed in `ingress` are allowed). Additional values may be introduced in future server versions.
  - `ingress` FirewallRule[]
    - `protocol` string, required — IP protocol. Known values: `tcp`, `udp`. Additional values may be introduced in future server versions.
    - `portStart` integer, required — Start of port range (inclusive). Required.
    - `portEnd` integer — End of port range (inclusive). Omit for single-port rules.
    - `sourceCidrs` string[] — Allowed source CIDRs in IPv6 notation (e.g. `2001:db8::/32`). Omit or empty to allow any source. IPv4 CIDRs are rejected.
    - `description` string

## Response `200`

Updated VM

- VM
  - `id` string, required
  - `name` string, required
  - `orgId` string, required
  - `machineName` string
  - `sourceName` string — Source snapshot or image name (empty on fresh boot).
  - `firewall` FirewallPolicy
    - `mode` string, required — Firewall mode. Known values: `open` (allow all inbound traffic), `restricted` (deny by default; only rules listed in `ingress` are allowed). Additional values may be introduced in future server versions.
    - `ingress` FirewallRule[]
      - `protocol` string, required — IP protocol. Known values: `tcp`, `udp`. Additional values may be introduced in future server versions.
      - `portStart` integer, required — Start of port range (inclusive). Required.
      - `portEnd` integer — End of port range (inclusive). Omit for single-port rules.
      - `sourceCidrs` string[] — Allowed source CIDRs in IPv6 notation (e.g. `2001:db8::/32`). Omit or empty to allow any source. IPv4 CIDRs are rejected.
      - `description` string
  - `effectiveFirewall` FirewallPolicy
    - `mode` string, required — Firewall mode. Known values: `open` (allow all inbound traffic), `restricted` (deny by default; only rules listed in `ingress` are allowed). Additional values may be introduced in future server versions.
    - `ingress` FirewallRule[]
      - `protocol` string, required — IP protocol. Known values: `tcp`, `udp`. Additional values may be introduced in future server versions.
      - `portStart` integer, required — Start of port range (inclusive). Required.
      - `portEnd` integer — End of port range (inclusive). Omit for single-port rules.
      - `sourceCidrs` string[] — Allowed source CIDRs in IPv6 notation (e.g. `2001:db8::/32`). Omit or empty to allow any source. IPv4 CIDRs are rejected.
      - `description` string
  - `metadata` Metadata — Free-form string→string map. Server-enforced limits: up to 256 keys, key length 1–256 bytes, value length ≤4096 bytes, total JSON encoding ≤65536 bytes.
  - `envVars` EnvVars — Environment variable string→string map injected into the VM at boot. Keys must be 1–256 bytes and match shell-variable name (`[A-Za-z_][A-Za-z0-9_]*`); values may not contain newline, carriage return, or null bytes. Total JSON encoding ≤65536 bytes.
  - `publicIpv6` string
  - `cpu` integer, required
  - `memoryMiB` integer, required
  - `diskGiB` integer, required
  - `status` string, required — Lifecycle status. Known values: `provisioning`, `running`, `stopped`, `pausing`, `paused`, `resuming`, `deleting`, `error`. Terminal failure statuses are `error` and `stopped`; transitional values (`provisioning`, `pausing`, `resuming`, `deleting`) indicate the VM is in flight. Additional values may be introduced in future server versions; clients should treat unknown values as "in transition" rather than as hard errors.
  - `createdAt` string, date-time, required
  - `deletedAt` string, date-time, nullable
  - `ttl` TTL — Per-VM auto-action timer. The cycle ticks down while the VM is `running` and freezes on pause. `seconds` is the original cycle duration; refresh and PATCH-time updates reset to this value.
    - `seconds` integer, required — Cycle duration. Refresh resets to this value. Capped at 1 year (31536000s); larger values are rejected with 400.
    - `action` 'pause' | 'delete', required — Action taken on expiry. `pause` re-arms the cycle for the next running session; `delete` is terminal.
  - `expiresAtMs` integer — Absolute timestamp in ms when the TTL fires. Set only while the VM is `running` (the countdown freezes on pause).
  - `ttlRemainingMs` integer — Remaining cycle budget in ms. Set only while the VM is paused; restored to `expiresAtMs` on resume.
  - `pausedAt` string, date-time, nullable — When the VM became paused; null otherwise.

## Other responses

- `400` — Invalid request
- `401` — Missing or invalid credentials
- `404` — Resource not found
- `500` — Internal server error
- `502` — Upstream service error

## Changes

- **2026-05-09** `480d9714a7a5` — 6 info
  - added the optional property `effectiveFirewall` to the response with the `200` status
  - added the optional property `envVars` to the response with the `200` status
  - added the optional property `expiresAtMs` to the response with the `200` status
  - added the optional property `pausedAt` to the response with the `200` status
  - …2 more
- **2026-04-22** `fdb53b5a79b3` — 8 breaking, 1 warning, 14 info
  - removed the enum value `open` of the request property `mode`
  - removed the enum value `restricted` of the request property `mode`
  - removed the enum value `tcp` of the request property `ingress/items/protocol`
  - removed the enum value `udp` of the request property `ingress/items/protocol`
  - …19 more

[Change history](https://skmtc.dev/fastvm-org/apis/fastvm-api/changes/v1/vms/:id/firewall/patch.md)

---

[API](https://skmtc.dev/fastvm-org/apis/fastvm-api.md) · [All operations](https://skmtc.dev/fastvm-org/apis/fastvm-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/fastvm-org/fastvm-api/revisions/480d9714a7a5/schema)