Edit

Workspaces - Get Firewall Rules

Service:
Core
API Version:
v1

Returns the IP firewall rules for the workspace. This API is designed to help workspace administrators view the effective IP firewall rules. This feature is currently in preview.

Note

This API is part of a Preview release and is provided for evaluation and development purposes only. It may change based on feedback and is not recommended for production use.

Permissions

The caller must have viewer or higher workspace role.

Required Delegated Scopes

Workspace.Read.All or Workspace.ReadWrite.All

Microsoft Entra supported identities

This API supports the Microsoft identities listed in this section.

Identity Support
User Yes
Service principal and Managed identities Yes

Interface

GET https://api.fabric.microsoft.com/v1/workspaces/{workspaceId}/networking/communicationPolicy/inbound/firewall

URI Parameters

Name In Required Type Description
workspaceId
 path True

string (uuid)

Unique identifier of the workspace whose firewall rules are being queried.

Responses

Name Type Description
200 OK

InboundFirewallConfiguration

Request completed successfully.

Headers:

ETag string - The current ETag of the firewall configuration. Use this value in a subsequent PUT call's If-Match header to apply optimistic concurrency control.
429 Too Many Requests

ErrorResponse

The service rate limit was exceeded. The server returns a Retry-After header indicating, in seconds, how long the client must wait before sending additional requests.

Headers

Retry-After: integer
Other Status Codes

ErrorResponse

Common error codes:

  • UnknownError - An error occurred.

Examples

Example for getting workspace firewall rules

Sample request

GET https://api.fabric.microsoft.com/v1/workspaces/47482db6-4583-4672-86dd-999d0f8f4d7a/networking/communicationPolicy/inbound/firewall

Sample response

Status code:
200 
ETag: 0f8fad5b-d9cb-469f-a165-70867728950e
{
  "rules": [
    {
      "displayName": "SingleIPAddressRule",
      "value": "12.34.56.78"
    },
    {
      "displayName": "IPAddressRangeRule",
      "value": "12.34.56.78-12.34.56.89"
    },
    {
      "displayName": "CidrIPAddressRule",
      "value": "12.34.56.0/24"
    }
  ]
}

Definitions

Name Description
ErrorRelatedResource

The error related resource details object.
ErrorResponse

The error response.
ErrorResponseDetails

The error response details.
FirewallRule

Defines a firewall rule, identified by its name and containing a single IP address, an IP address range, or a CIDR IP address as its value.
InboundFirewallConfiguration

This object defines the complete set of firewall rules to manage inbound access protection as part of a workspace’s networking communication policy. It ensures that only explicitly authorized IP addresses are permitted for inbound communication. When submitted via the PUT API, this object creates or fully replaces the existing IP firewall configuration for the workspace. These rules are enforced only when the workspace’s network communication policy has inbound.publicAccessRules.defaultAction set to Deny.

ErrorRelatedResource

Object

The error related resource details object.

Name Type Description
resourceId

string

The resource ID that's involved in the error.
resourceType

string

The type of the resource that's involved in the error.

ErrorResponse

Object

The error response.

Name Type Description
errorCode

string

A specific identifier that provides information about an error condition, allowing for standardized communication between our service and its users.
isRetriable

boolean

When true, the request can be retried. Use the Retry-After response header to determine the delay, if available.
message

string

A human readable representation of the error.
moreDetails

ErrorResponseDetails[]

List of additional error details.
relatedResource

ErrorRelatedResource

The error related resource details.
requestId

string (uuid)

ID of the request associated with the error.

ErrorResponseDetails

Object

The error response details.

Name Type Description
errorCode

string

A specific identifier that provides information about an error condition, allowing for standardized communication between our service and its users.
message

string

A human readable representation of the error.
relatedResource

ErrorRelatedResource

The error related resource details.

FirewallRule

Object

Defines a firewall rule, identified by its name and containing a single IP address, an IP address range, or a CIDR IP address as its value.

Name Type Description
displayName

string

Specifies the name of the rule. Display names can be up to 128 characters in length and are required to be unique per workspace.
value

string

Specifies the value of the rule, specified as a single IP address, an IP address range, or a CIDR IP address.

InboundFirewallConfiguration

Object

This object defines the complete set of firewall rules to manage inbound access protection as part of a workspace’s networking communication policy. It ensures that only explicitly authorized IP addresses are permitted for inbound communication. When submitted via the PUT API, this object creates or fully replaces the existing IP firewall configuration for the workspace. These rules are enforced only when the workspace’s network communication policy has inbound.publicAccessRules.defaultAction set to Deny.

Name Type Description
rules

FirewallRule[]

A list of rules that define IP addresses permitted for inbound access. Each rule may include a name and a single IP address, an IP address range, or a CIDR IP address. A maximum of 256 rules can be specified per workspace.