emfirge_plan_verdict
Check a proposed change on a branch before it is applied: a Terraform plan, a CloudFormation change set, AWS API calls, or AWS CLI commands.
Parameters
branch_id: string · required; format: terraform | aws-api | aws-cli | cloudformation · required; plan: object or string array · required
{
"branch_id": "branch_456",
"format": "aws-cli",
"plan": ["aws ec2 authorize-security-group-ingress --group-id NAME_132 --protocol tcp --port 22 --cidr 0.0.0.0/0"]
}
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
{
"plan_id": "plan_01",
"input_sha256": "9b1e…07aa",
"applied": [ /* … normalized changes … */ ],
"rejected": [], "unmodeled": [], "unknown_fields": [],
"verdict": {
"decision": "block",
"reasons": [{ "level": "block", "code": "introduced_critical_exposure", "message": "Introduced Critical exposure" }]
},
"verdict_id": "e83a…5b02",
"branch_revision": "7c2d…e410",
"handback": { "plan_id": "plan_01", "input_sha256": "9b1e…07aa", "verdict_id": "e83a…5b02" /* … */ }
}
Validation, behavior, and limits
Use the output of terraform show -json for Terraform, a change-set document for CloudFormation, a list of API calls for aws-api, or a list of command strings for aws-cli. Emfirge never runs the change.
Every input is normalized into the same typed change model, so an equivalent change gets the same verdict whichever format it arrives in.
Changes Emfirge cannot model are listed in rejected or unmodeled and make the verdict stricter; they are never silently treated as safe.
The response includes the hand-back: input_sha256 binds the exact input you submitted to the verdict it received.