diff --git a/cmd/metal-api/internal/service/v1/firewall.go b/cmd/metal-api/internal/service/v1/firewall.go
index f0289007b..727d6e1dc 100644
--- a/cmd/metal-api/internal/service/v1/firewall.go
+++ b/cmd/metal-api/internal/service/v1/firewall.go
@@ -19,7 +19,7 @@ type FirewallEgressRule struct {
 type FirewallIngressRule struct {
 	Protocol string   `json:"protocol,omitempty" description:"the protocol for the rule, defaults to tcp" enum:"tcp|udp" optional:"true"`
 	Ports    []int    `json:"ports" description:"the ports affected by this rule"`
-	To       []string `json:"to" description:"the cidrs affected by this rule"`
+	To       []string `json:"to,omitempty" description:"the cidrs affected by this rule" optional:"true"`
 	From     []string `json:"from" description:"the cidrs affected by this rule"`
 	Comment  string   `json:"comment,omitempty" description:"an optional comment describing what this rule is used for" optional:"true"`
 }
diff --git a/spec/metal-api.json b/spec/metal-api.json
index c5a1cb49f..7182ad22f 100644
--- a/spec/metal-api.json
+++ b/spec/metal-api.json
@@ -1365,8 +1365,7 @@
       },
       "required": [
         "from",
-        "ports",
-        "to"
+        "ports"
       ]
     },
     "v1.FirewallResponse": {