XG - enable/disable firewall rule with API

no, you have to send the full API-packet every time.

... but if you wrote the WEB-IU by yourself, you may add/merge static content+dynamic-content+other static content ... before you send the data.

Thanks!
I've seen that it should be possible to export the XML of the firewall rules, but if I select "Export selective configuration" I don't have the Firewall rules, or I don't know which of the hundreds options should I choose.
In this way I can take the exported XML, edit the status and use it in the API call.

Depending on your version. In some Firmware versions it was called SecurityPolicy. V19.0 has firewallrule

Found it, thanks!
From the export I've copied a rule and I've created this XML (just changing the name of the rule):

<Request>
<Login>
 <Username>admin</Username>
 <Password passwordform='plain'>admin pw</Password>
</Login>
<Set operation='update'>
 <SecurityPolicy transactionid="">
    <Name>Test002</Name>
    <Description/>
    <IPFamily>IPv4</IPFamily>
    <Status>Disable</Status>
    <Position>After</Position>
    <PolicyType>Network</PolicyType>
    <After>
      <Name>S.Maria->LAN</Name>
    </After>
    <SourceZones>
      <Zone>LAN</Zone>
    </SourceZones>
    <DestinationZones>
      <Zone>Studi</Zone>
    </DestinationZones>
    <Schedule>All The Time</Schedule>
    <Action>Accept</Action>
    <LogTraffic>Disable</LogTraffic>
    <MatchIdentity>Disable</MatchIdentity>
    <DSCPMarking>-1</DSCPMarking>
    <ApplicationControl>None</ApplicationControl>
    <ApplicationBaseQoSPolicy>Revoke</ApplicationBaseQoSPolicy>
    <WebFilter>None</WebFilter>
    <WebCategoryBaseQoSPolicy>Revoke</WebCategoryBaseQoSPolicy>
    <IntrusionPrevention>None</IntrusionPrevention>
    <TrafficShappingPolicy>None</TrafficShappingPolicy>
    <ApplyNAT>Disable</ApplyNAT>
    <OverrideGatewayDefaultNATPolicy>Disable</OverrideGatewayDefaultNATPolicy>
    <PrimaryGateway/>
    <BackupGateway/>
    <ScanHTTP>Disable</ScanHTTP>
    <ScanHTTPS>Disable</ScanHTTPS>
    <Sandstorm>Disable</Sandstorm>
    <BlockQuickQuic>Disable</BlockQuickQuic>
    <ScanFTP>Disable</ScanFTP>
    <SourceSecurityHeartbeat>Disable</SourceSecurityHeartbeat>
    <MinimumSourceHBPermitted>No Restriction</MinimumSourceHBPermitted>
    <DestSecurityHeartbeat>Disable</DestSecurityHeartbeat>
    <MinimumDestinationHBPermitted>No Restriction</MinimumDestinationHBPermitted>
  </SecurityPolicy>
</Set>
</Request>

But I get <Status code="529">Input request file is Invalid</Status>
Thanks for the support!

LuCar Toni any idea why the XML isn't working?

Check the apiparser log in /log/

reading old posts about this lets me think about a proper way to implement your desired action:

I have a firewall-rule with static name, what should be updated through API call to be enabled or disabled.
My question concerning to the thread is:

What is the smartest way to enable/disable a firewall rule and keep it attached to a Firewall group since API for <FirewallRule> does not support <FirewallRuleGroup>.

LuCar Toni - you mentioned that there is a way to read the config through 'GET", save it into an array and update necessary content, see API does not support Firewall Rule Group assignment after changing rule? / API drops Firewall Rule Group assignment - Discussions - Sophos (XG) Firewall - Sophos Community

Kindly ask you all what is the easiest but most performant way?