---
title: "Patch firewall policy"
method: PATCH
path: "/v1/vms/{id}/firewall"
tags: ["firewall"]
---

# Patch firewall policy

`PATCH /v1/vms/{id}/firewall`

Updates `mode` and/or `ingress` on the firewall policy. Passing
`ingress: []` clears all rules; omitting `ingress` leaves rules
unchanged.

## Request body

- PatchFirewallRequest — Partial firewall update. Both fields are optional. `ingress: []` clears all rules; omitting `ingress` leaves the existing rules unchanged. An empty body (`{}`) is accepted as a no-op re-normalize.
  - `mode` string — Firewall mode. Known values: `open` (allow all inbound traffic), `restricted` (deny by default; only rules listed in `ingress` are allowed). Additional values may be introduced in future server versions.
  - `ingress` FirewallRule[]
    - `protocol` string, required — IP protocol. Known values: `tcp`, `udp`. Additional values may be introduced in future server versions.
    - `portStart` integer, required — Start of port range (inclusive). Required.
    - `portEnd` integer — End of port range (inclusive). Omit for single-port rules.
    - `sourceCidrs` string[] — Allowed source CIDRs in IPv6 notation (e.g. `2001:db8::/32`). Omit or empty to allow any source. IPv4 CIDRs are rejected.
    - `description` string

## Response `200`

Updated VM

- VM
  - `id` string, required
  - `name` string, required
  - `orgId` string, required
  - `machineName` string
  - `sourceName` string — Source snapshot or image name (empty on fresh boot).
  - `firewall` FirewallPolicy
    - `mode` string, required — Firewall mode. Known values: `open` (allow all inbound traffic), `restricted` (deny by default; only rules listed in `ingress` are allowed). Additional values may be introduced in future server versions.
    - `ingress` FirewallRule[]
      - `protocol` string, required — IP protocol. Known values: `tcp`, `udp`. Additional values may be introduced in future server versions.
      - `portStart` integer, required — Start of port range (inclusive). Required.
      - `portEnd` integer — End of port range (inclusive). Omit for single-port rules.
      - `sourceCidrs` string[] — Allowed source CIDRs in IPv6 notation (e.g. `2001:db8::/32`). Omit or empty to allow any source. IPv4 CIDRs are rejected.
      - `description` string
  - `metadata` Metadata — Free-form string→string map. Server-enforced limits: up to 256 keys, key length 1–256 bytes, value length ≤4096 bytes, total JSON encoding ≤65536 bytes.
  - `publicIpv6` string
  - `cpu` integer, required
  - `memoryMiB` integer, required
  - `diskGiB` integer, required
  - `status` string, required — Lifecycle status. Known values: `provisioning`, `running`, `stopped`, `deleting`, `error`. Terminal failure statuses are `error` and `stopped`; any other non-`running` value indicates the VM is still transitioning. Additional values may be introduced in future server versions; clients should treat unknown values as "in transition" rather than as hard errors.
  - `createdAt` string, date-time, required
  - `deletedAt` string, date-time, nullable

## Other responses

- `400` — Invalid request
- `401` — Missing or invalid credentials
- `404` — Resource not found
- `500` — Internal server error
- `502` — Upstream worker error

## Changes

- **2026-04-22** `fdb53b5a79b3` — 8 breaking, 1 warning, 14 info
  - removed the enum value `open` of the request property `mode`
  - removed the enum value `restricted` of the request property `mode`
  - removed the enum value `tcp` of the request property `ingress/items/protocol`
  - removed the enum value `udp` of the request property `ingress/items/protocol`
  - …19 more

[Change history](https://skmtc.dev/fastvm-org/apis/fastvm-api/changes/v1/vms/:id/firewall/patch.md)

---

[API](https://skmtc.dev/fastvm-org/apis/fastvm-api.md) · [All operations](https://skmtc.dev/fastvm-org/apis/fastvm-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/fastvm-org/fastvm-api/revisions/fdb53b5a79b3/schema)