You can use the orchestrator to enforce change based on a:
puppet job run --nodes <COMMA-SEPARATED LIST OF NODE NAMES>
puppet job run --query 'nodes[certname] { facts {name = "operatingsystem" and value = "Debian" }}'
If you're putting together your own tools for running Puppet or want to enable CI workflows across your infrastructure, use the orchestrator API.