Rules

Download OpenAPI specification:Download

Rules APIs provided by Detection and Response services are used to CRUD rules

Create rule

Creates a new recommendation rule. Returns the rule_id used to reference the rule in subsequent requests, along with the rule data.

SecurityHTTP: risk_access_token
Request
Request Body schema: application/json
required
name
string (rule_name)

Name of the recommendation rule. Must be unique across the tenant. Autogenerated if not provided.

priority
required
integer (rule_priority) [ 1 .. 1000 ]

Priority of the recommendation rule, which determines the order in which rules are evaluated. Rules are evaluated from smallest to biggest priority value and only the first rule to match will apply. Priority value must be unique.

recommendation
required
string (rule_recommendation_type)

Recommendation type

Enum: "challenge" "deny" "trust" "allow"
enabled
boolean (rule_enabled)
Default: false

Whether or not the rule will be evaluated.

mode
required
string (rule_mode)

Allows you to simulate a rule and evaluate its impact before releasing it to production. The simulation occurs each time a recommendation is requested. If a preview rule matches the request (meaning, its priority is higher than all matching rules), the response will include this preview rule and what the recommendation would have been if all rules were in production.

Enum: "preview" "production"
type
required
string (rule_type)

Default type, must be "risk"

Value: "risk"
description
string (rule_description)

Description for the rule

required
Array of objects (matchers)

Contains a set of activity matchers that define the rule matching logic

Responses
201

Rules created and stored successfully

400

Bad request

401

Invalid authentication

403

Invalid authorization (e.g, unauthorized resource)

409

Unique field collision

429

Rate limit reached

500

Internal error

post/rules
Request samples
application/json
{
  • "name": "Block risky countries",
  • "priority": 10,
  • "recommendation": "challenge",
  • "enabled": false,
  • "mode": "preview",
  • "type": "risk",
  • "description": "string",
  • "matchers": [
    ]
}
Response samples
application/json
{
  • "message": "string",
  • "rule_id": "728c1541-d6d1-4290-9a53-cdf01dd32d60",
  • "data": {
    }
}

Get all rules

Retrieves a list of all recommendation rules

SecurityHTTP: risk_access_token
Responses
200

Rules retrieved successfully

400

Bad request

401

Invalid authentication

403

Invalid authorization (e.g, unauthorized resource)

429

Rate limit reached

500

Internal error

get/rules
Request samples 
Response samples 
application/json
{
  • "data": [
    ]
}
Get rule by ID
Retrieves a specific recommendation rule by its ID


SecurityHTTP: risk_access_token 
Request 
path Parameters
rule_id
required
string
ID of the recommendation rule


 
Responses 
200
Rule retrieved successfully


400
Bad request


401
Invalid authentication


403
Invalid authorization (e.g, unauthorized resource)


404
Not found


429
Rate limit reached


500
Internal error


get/rules/{rule_id}
Request samples 
Response samples 
application/json
{
  • "id": "string",
  • "data": {
    }
}
Update rule by ID
Updates a specific recommendation rule


SecurityHTTP: risk_access_token 
Request 
path Parameters
rule_id
required
string
ID of the recommendation rule


 
Request Body schema: application/json
required
name
string (rule_name) 
Name of the recommendation rule. Must be unique across the tenant. Autogenerated if not provided.


 
priority
required
integer (rule_priority)   [ 1 .. 1000 ] 
Priority of the recommendation rule, which determines the order in which rules are evaluated. Rules are evaluated from smallest to biggest priority value and only the first rule to match will apply. Priority value must be unique.


 
recommendation
required
string (rule_recommendation_type) 
Recommendation type


 Enum: "challenge" "deny" "trust" "allow"  
enabled
boolean (rule_enabled) 
 Default:  false
Whether or not the rule will be evaluated.


 
mode
required
string (rule_mode) 
Allows you to simulate a rule and evaluate its impact before releasing it to production. The simulation occurs each time a recommendation is requested. If a preview rule matches the request (meaning, its priority is higher than all matching rules), the response will include this preview rule and what the recommendation would have been if all rules were in production.


 Enum: "preview" "production"  
type
required
string (rule_type) 
Default type, must be "risk"


 Value: "risk"  
description
string (rule_description) 
Description for the rule


 
required
Array of objects (matchers) 
Contains a set of activity matchers that define the rule matching logic


 
Responses 
200
Rule updated successfully


400
Bad request


401
Invalid authentication


403
Invalid authorization (e.g, unauthorized resource)


404
Not found


429
Rate limit reached


500
Internal error


put/rules/{rule_id}
Request samples 
application/json
{
  • "name": "Block risky countries",
  • "priority": 10,
  • "recommendation": "challenge",
  • "enabled": false,
  • "mode": "preview",
  • "type": "risk",
  • "description": "string",
  • "matchers": [
    ]
}
Response samples 
application/json
{
  • "message": "string",
  • "data": {
    }
}
Delete rule by ID
Deletes a specific recommendation rule. Note that you can also disable rules if needed using the enabled rule attribute.


SecurityHTTP: risk_access_token 
Request 
path Parameters
rule_id
required
string
ID of the recommendation rule


 
Responses 
200
Rule updated successfully


400
Bad request


401
Invalid authentication


403
Invalid authorization (e.g, unauthorized resource)


404
Not found


429
Rate limit reached


500
Internal error


delete/rules/{rule_id}
Request samples 
Response samples 
application/json
{
  • "message": "string"
}