Rules

Download OpenAPI specification:Download

Rules APIs provided by Detection and Response services are used to CRUD rules

Create rule

Creates a new recommendation rule. Returns the rule_id used to reference the rule in subsequent requests.

SecurityHTTP: risk_access_token
Request
Request Body schema: application/json
required
name
string (rule_name)

Name of the recommendation rule. Must be unique across the tenant. Auto generated if not provided.

priority
required
integer (rule_priority) [ 1 .. 1000 ]

Priority of the recommendation rule, which determines the order in which rules are evaluated. Rules are evaluated from smallest to biggest priority value and only the first rule to match will apply. Priority value must be unique.

required
ip_cidrs (object) or device_ids (object) or device_fingerprints (object) or user_ids (object) or country_codes (object) or browser_names (object) or os_versions (object) (matcher)

Activity field matcher. Only one matcher can be defined per rule.

recommendation
required
string (rule_recommendation_type)

Recommendation type

Enum: "CHALLENGE" "DENY" "TRUST"
enabled
required
boolean (rule_enabled)

Whether or not the rule will be evaluated

mode
required
string (rule_mode)

Allows you to simulate a rule and evaluate its impact before releasing it to production. The simulation occurs each time a recommendation is requested. If a preview rule matches the request (meaning, its priority is higher than all matching rules), the response will include this preview rule and what the recommendation would have been if all rules were in production.

Enum: "PREVIEW" "PRODUCTION"
type
required
string

Type of the rule.

Responses
201

Rule created successfully

400

Bad request

401

Invalid authorization

409

Unique field collision

500

Internal error

post/rules
Request samples
application/json
{
  • "name": "Block risky countries",
  • "priority": 10,
  • "matcher": {
    },
  • "recommendation": "CHALLENGE",
  • "enabled": true,
  • "mode": "PREVIEW",
  • "type": "risk"
}
Response samples
application/json
{
  • "message": "string",
  • "rule_id": "string"
}

Get all rules

Retrieves a list of all recommendation rules

SecurityHTTP: risk_access_token
Responses
200

Rules retrieved successfully

400

Bad request

401

Invalid authorization

500

Internal error

get/rules
Request samples 
Response samples 
application/json
{
  • "data": [
    ]
}
Get rule by ID
Retrieves a specific recommendation rule by its ID


SecurityHTTP: risk_access_token 
Request 
path Parameters
rule_id
required
string
ID of the recommendation rule


 
Responses 
200
Rule retrieved successfully


400
Bad request


401
Invalid authorization


404
Not found


500
Internal error


get/rules/{rule_id}
Request samples 
Response samples 
application/json
{
  • "id": "string",
  • "data": {
    }
}
Update rule by ID
Updates a specific recommendation rule


SecurityHTTP: risk_access_token 
Request 
path Parameters
rule_id
required
string
ID of the recommendation rule


 
Request Body schema: application/json
required
name
string (rule_name) 
Name of the recommendation rule. Must be unique across the tenant. Auto generated if not provided.


 
priority
required
integer (rule_priority)   [ 1 .. 1000 ] 
Priority of the recommendation rule, which determines the order in which rules are evaluated. Rules are evaluated from smallest to biggest priority value and only the first rule to match will apply. Priority value must be unique.


 
required
ip_cidrs (object) or device_ids (object) or device_fingerprints (object) or user_ids (object) or country_codes (object) or browser_names (object) or os_versions (object) (matcher) 
Activity field matcher. Only one matcher can be defined per rule.


 
recommendation
required
string (rule_recommendation_type) 
Recommendation type


 Enum: "CHALLENGE" "DENY" "TRUST"  
enabled
required
boolean (rule_enabled) 
Whether or not the rule will be evaluated


 
mode
required
string (rule_mode) 
Allows you to simulate a rule and evaluate its impact before releasing it to production. The simulation occurs each time a recommendation is requested. If a preview rule matches the request (meaning, its priority is higher than all matching rules), the response will include this preview rule and what the recommendation would have been if all rules were in production.


 Enum: "PREVIEW" "PRODUCTION"  
type
required
string
Type of the rule.


 
Responses 
200
Rule updated successfully


400
Bad request


401
Invalid authorization


404
Not found


500
Internal error


put/rules/{rule_id}
Request samples 
application/json
{
  • "name": "Block risky countries",
  • "priority": 10,
  • "matcher": {
    },
  • "recommendation": "CHALLENGE",
  • "enabled": true,
  • "mode": "PREVIEW",
  • "type": "risk"
}
Response samples 
application/json
{
  • "message": "string"
}
Delete rule by ID
Deletes a specific recommendation rule. Note that you can also disable rules if needed using the enabled rule attribute.


SecurityHTTP: risk_access_token 
Request 
path Parameters
rule_id
required
string
ID of the recommendation rule


 
Responses 
200
Rule updated successfully


400
Bad request


401
Invalid authorization


404
Not found


500
Internal error


delete/rules/{rule_id}
Request samples 
Response samples 
application/json
{
  • "message": "string"
}