Rules

Download OpenAPI specification:Download

Rules APIs provided by Detection and Response services are used to CRUD rules

Create rule

Creates a new recommendation rule. Returns the rule_id used to reference the rule in subsequent requests, along with the rule data.

SecurityHTTP: risk_access_token
Request
Request Body schema: application/json
required
name
string (rule_name)

Name of the recommendation rule. Must be unique across the tenant. Autogenerated if not provided.

priority
required
integer (rule_priority) [ 1 .. 1000 ]

Priority of the recommendation rule, which determines the order in which rules are evaluated. Rules are evaluated from smallest to biggest priority value and only the first rule to match will apply. Priority value must be unique.

recommendation
required
string (rule_recommendation_type)

Recommendation type

Enum: "challenge" "deny" "trust" "allow"
enabled
boolean (rule_enabled)
Default: false

Whether or not the rule will be evaluated.

mode
required
string (rule_mode)

Allows you to simulate a rule and evaluate its impact before releasing it to production. The simulation occurs each time a recommendation is requested. If a preview rule matches the request (meaning, its priority is higher than all matching rules), the response will include this preview rule and what the recommendation would have been if all rules were in production.

Enum: "preview" "production"
type
required
string (rule_type)

Default type, must be "risk"

Value: "risk"
description
string (rule_description)

Description for the rule

required
Array of objects (matchers)

Contains a set of activity matchers that define the rule matching logic

Responses
201

Rules created and stored successfully

400

Bad request

401

Invalid authentication

403

Invalid authorization (e.g, unauthorized resource)

409

Unique field collision

429

Rate limit reached

500

Internal error

post/rules
Request samples
application/json
{
  • "name": "Block risky countries",
  • "priority": 10,
  • "recommendation": "challenge",
  • "enabled": false,
  • "mode": "preview",
  • "type": "risk",
  • "description": "string",
  • "matchers": [
    ]
}
Response samples
application/json
{
  • "message": "string",
  • "rule_id": "728c1541-d6d1-4290-9a53-cdf01dd32d60",
  • "data": {
    }
}

Get all rules

Retrieves a list of all recommendation rules

SecurityHTTP: risk_access_token
Responses
200

Rules retrieved successfully

400

Bad request

401

Invalid authentication

403

Invalid authorization (e.g, unauthorized resource)

429

Rate limit reached

500

Internal error

get/rules
Request samples
Response samples
application/json
{
  • "data": [
    ]
}

Get rule by ID

Retrieves a specific recommendation rule by its ID

SecurityHTTP: risk_access_token
Request
path Parameters
rule_id
required
string

ID of the recommendation rule

Responses
200

Rule retrieved successfully

400

Bad request

401

Invalid authentication

403

Invalid authorization (e.g, unauthorized resource)

404

Not found

429

Rate limit reached

500

Internal error

get/rules/{rule_id}
Request samples
Response samples
application/json
{
  • "id": "string",
  • "data": {
    }
}

Update rule by ID

Updates a specific recommendation rule

SecurityHTTP: risk_access_token
Request
path Parameters
rule_id
required
string

ID of the recommendation rule

Request Body schema: application/json
required
name
string (rule_name)

Name of the recommendation rule. Must be unique across the tenant. Autogenerated if not provided.

priority
required
integer (rule_priority) [ 1 .. 1000 ]

Priority of the recommendation rule, which determines the order in which rules are evaluated. Rules are evaluated from smallest to biggest priority value and only the first rule to match will apply. Priority value must be unique.

recommendation
required
string (rule_recommendation_type)

Recommendation type

Enum: "challenge" "deny" "trust" "allow"
enabled
boolean (rule_enabled)
Default: false

Whether or not the rule will be evaluated.

mode
required
string (rule_mode)

Allows you to simulate a rule and evaluate its impact before releasing it to production. The simulation occurs each time a recommendation is requested. If a preview rule matches the request (meaning, its priority is higher than all matching rules), the response will include this preview rule and what the recommendation would have been if all rules were in production.

Enum: "preview" "production"
type
required
string (rule_type)

Default type, must be "risk"

Value: "risk"
description
string (rule_description)

Description for the rule

required
Array of objects (matchers)

Contains a set of activity matchers that define the rule matching logic

Responses
200

Rule updated successfully

400

Bad request

401

Invalid authentication

403

Invalid authorization (e.g, unauthorized resource)

404

Not found

429

Rate limit reached

500

Internal error

put/rules/{rule_id}
Request samples
application/json
{
  • "name": "Block risky countries",
  • "priority": 10,
  • "recommendation": "challenge",
  • "enabled": false,
  • "mode": "preview",
  • "type": "risk",
  • "description": "string",
  • "matchers": [
    ]
}
Response samples
application/json
{
  • "message": "string",
  • "data": {
    }
}

Delete rule by ID

Deletes a specific recommendation rule. Note that you can also disable rules if needed using the enabled rule attribute.

SecurityHTTP: risk_access_token
Request
path Parameters
rule_id
required
string

ID of the recommendation rule

Responses
200

Rule updated successfully

400

Bad request

401

Invalid authentication

403

Invalid authorization (e.g, unauthorized resource)

404

Not found

429

Rate limit reached

500

Internal error

delete/rules/{rule_id}
Request samples
Response samples
application/json
{
  • "message": "string"
}