---
title: "Get all ticket creation rules"
method: GET
path: "/api/v2/security/findings/automation/ticket_creation_rules"
tags: ["Security Monitoring"]
---

# Get all ticket creation rules

`GET /api/v2/security/findings/automation/ticket_creation_rules`

Get all ticket creation rules for the current organization.

## Query parameters

- `page[size]` integer
- `page[number]` integer

## Response `200`

Successfully retrieved the list of ticket creation rules

- TicketCreationRulesResponse — A list of ticket creation rules with pagination metadata.
  - `data` TicketCreationRuleDataResponse[], required — A list of ticket creation rule data objects.
    - `attributes` TicketCreationRuleAttributesResponse, required — Attributes of a ticket creation rule returned by the API.
      - `action` TicketCreationRuleActionResponse, required — The action to take when the ticket creation rule matches a finding.
        - `assignee_id` string, uuid — The UUID of the default assignee for created tickets.
        - `auto_disabled_reason` string — The reason the rule was automatically disabled by the system due to a ticketing integration error.
        - `fields` object — Custom fields of the Jira issue to create. For the list of available fields, see [Jira documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v2/api-group-issues/#api-rest-api-2-issue-createmeta-projectidorkey-issuetypes-issuetypeid-get).
        - `max_tickets_per_day` integer, required — The maximum number of tickets the rule may create per day. If exceeded, one final ticket will be created, explaining the limit was hit and link back to the responsible rule.
        - `project_id` string, uuid, required — The UUID of the case management project.
        - `target` 'jira' | 'case_management', required — The ticketing system to create tickets in.
      - `created_at` integer, required — The Unix timestamp in milliseconds when the rule was created.
      - `created_by` AutomationRuleCreatedBy, required — The user or Datadog system who created the rule.
        - `id` string, required — The actor's identifier (a user UUID or a system identifier).
        - `name` string, required — The name of the actor.
        - `type` 'user' | 'system', required — Whether the actor is a user or the Datadog system.
      - `enabled` boolean, required — Whether the ticket creation rule is enabled.
      - `modified_at` integer, required — The Unix timestamp in milliseconds when the rule was last modified.
      - `modified_by` AutomationRuleModifiedBy, required — The user or Datadog system who last modified the rule.
        - `id` string, required — The actor's identifier (a user UUID or a system identifier).
        - `name` string, required — The name of the actor.
        - `type` 'user' | 'system', required — Whether the actor is a user or the Datadog system.
      - `name` string, required — The name of the ticket creation rule.
      - `rule` AutomationRuleScope, required — Defines the scope of findings to which the automation rule applies.
        - `finding_types` SecurityFindingType[], required — The list of security finding types that the automation rule applies to.
        - `query` string — A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/).
    - `id` string, uuid, required — The ID of the ticket creation rule.
    - `type` 'ticket_creation_rules', required — The JSON:API type for ticket creation rules.
  - `links` SecurityAutomationRulesLinks, required — Pagination links for the list of automation rules.
    - `first` string, required — Link to the first page of results.
    - `last` string, required — Link to the last page of results.
    - `next` string — Link to the next page of results.
    - `prev` string — Link to the previous page of results.
  - `meta` SecurityAutomationRulesMeta, required — Metadata for the list of automation rules.
    - `page` SecurityAutomationRulesPageInfo, required — Pagination information for the list of automation rules.
      - `total_filtered_count` integer, required — The total number of rules matching the current filter.

## Other responses

- `403` — Forbidden
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)