BatchUpdateRules

Updates existing rules or creates rules that do not exist.

PUT /api/v1/rules:batchUpdate

BatchUpdateRules

cURL

curl --request PUT \
  --url https://api.siftstack.com/api/v1/rules:batchUpdate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "rules": [
    {
      "name": "<string>",
      "description": "<string>",
      "conditions": [
        {
          "expression": {},
          "actions": [
            {
              "actionType": "ACTION_KIND_UNSPECIFIED",
              "configuration": {},
              "ruleActionId": "<string>"
            }
          ],
          "ruleConditionId": "<string>"
        }
      ],
      "metadata": [
        {
          "key": {
            "name": "<string>",
            "type": "METADATA_KEY_TYPE_UNSPECIFIED",
            "archivedDate": "2023-11-07T05:31:56Z",
            "isArchived": true
          },
          "stringValue": "<string>",
          "numberValue": 123,
          "booleanValue": true,
          "archivedDate": "2023-11-07T05:31:56Z",
          "isArchived": true
        }
      ],
      "ruleId": "<string>",
      "assetId": "<string>",
      "isEnabled": true,
      "organizationId": "<string>",
      "versionNotes": "<string>",
      "clientKey": "<string>",
      "assetConfiguration": {
        "assetIds": [
          "<string>"
        ],
        "tagIds": [
          "<string>"
        ]
      },
      "isExternal": true,
      "isArchived": true,
      "isLiveEvaluationEnabled": true
    }
  ],
  "validateOnly": true,
  "overrideExpressionValidation": true
}
'

200

{
  "success": true,
  "rulesCreatedCount": 123,
  "rulesUpdatedCount": 123,
  "validateOnly": true,
  "validationResults": [
    {
      "assetExpressionValidationResults": [
        {
          "assetId": "<string>",
          "assetName": "<string>",
          "assetTagId": "<string>",
          "error": "<string>"
        }
      ],
      "ruleId": "<string>",
      "clientKey": "<string>",
      "error": "<string>",
      "ruleName": "<string>"
    }
  ],
  "createdRuleIdentifiers": [
    {
      "ruleId": "<string>",
      "name": "<string>",
      "clientKey": "<string>"
    }
  ]
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

rules · rules are limited 1000 rules at a time · object[] · required

Show child attributes

validateOnly · boolean

If validate_only is true, the request will only validate the request and not save the rules.

overrideExpressionValidation · boolean

Discouraged escape hatch for saving rules whose expression cannot be fully validated server-side. When true:

• Per-asset expression validation errors (e.g. channel not present on the in-scope asset) are returned in validation_results for visibility but do not block the save.
• If the rule's UDF/calculated-channel inlining cannot resolve types (typically because the referenced channels haven't been ingested yet, or there are too many distinct identifiers for the type-inference budget) the rule is still persisted, but its is_live_evaluation_enabled is forced to false. Live alerts will skip it; report generation and on-demand EvaluateRules calls still work because they re-resolve types at run time. To bring such a rule back online, fix the underlying problem (ingest the channels, simplify the expression, etc.) and reissue an update with is_live_evaluation_enabled = true.

Marked deprecated = true because new integrations should validate input before submitting; existing SDK call sites that rely on this flag continue to work.

Response

200

application/json

A successful response.

success · boolean · required

rulesCreatedCount · integer<int32> · required

The total number of rules created in the request. If validate_only is true, this will indicate how many rules would have been created.

rulesUpdatedCount · integer<int32> · required

The total number of rules updated in the request. If validate_only is true, this will indicate how many rules would have been updated.

validateOnly · boolean · required

This will be true if the request only validated the request and did not save the rules.

validationResults · One ValidationResult per rule in the request will be returned · object[] · required

Show child attributes

createdRuleIdentifiers · object[] · required

The created rule id, name, version, and client key.

Show child attributes