---
title: "Create a ticket creation rule"
method: POST
path: "/api/v2/security/findings/automation/ticket_creation_rules"
tags: ["Security Monitoring"]
---

# Create a ticket creation rule

`POST /api/v2/security/findings/automation/ticket_creation_rules`

Create a new ticket creation rule for the current organization.

## Request body

- TicketCreationRuleCreateRequest — The body of a ticket creation rule create request.
  - `data` TicketCreationRuleDataCreate, required — The data object for a ticket creation rule create or update request.
    - `attributes` TicketCreationRuleAttributesCreate, required — Attributes for creating or updating a ticket creation rule.
      - `action` TicketCreationRuleAction, required — The action to take when the ticket creation rule matches a finding.
        - `assignee_id` string, uuid — The UUID of the default assignee for created tickets.
        - `fields` object — Custom fields of the Jira issue to create. For the list of available fields, see [Jira documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v2/api-group-issues/#api-rest-api-2-issue-createmeta-projectidorkey-issuetypes-issuetypeid-get).
        - `max_tickets_per_day` integer, required — The maximum number of tickets the rule may create per day. If exceeded, one final ticket will be created, explaining the limit was hit and link back to the responsible rule.
        - `project_id` string, uuid, required — The UUID of the case management project.
        - `target` 'jira' | 'case_management', required — The ticketing system to create tickets in.
      - `enabled` boolean — Whether the ticket creation rule is enabled.
      - `name` string, required — The name of the ticket creation rule.
      - `rule` AutomationRuleScope, required — Defines the scope of findings to which the automation rule applies.
        - `finding_types` SecurityFindingType[], required — The list of security finding types that the automation rule applies to.
        - `query` string — A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/).
    - `type` 'ticket_creation_rules', required — The JSON:API type for ticket creation rules.

## Response `201`

Successfully created the ticket creation rule

- TicketCreationRuleResponse — A single ticket creation rule response.
  - `data` TicketCreationRuleDataResponse, required — The data object for a ticket creation rule returned by the API.
    - `attributes` TicketCreationRuleAttributesResponse, required — Attributes of a ticket creation rule returned by the API.
      - `action` TicketCreationRuleActionResponse, required — The action to take when the ticket creation rule matches a finding.
        - `assignee_id` string, uuid — The UUID of the default assignee for created tickets.
        - `auto_disabled_reason` string — The reason the rule was automatically disabled by the system due to a ticketing integration error.
        - `fields` object — Custom fields of the Jira issue to create. For the list of available fields, see [Jira documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v2/api-group-issues/#api-rest-api-2-issue-createmeta-projectidorkey-issuetypes-issuetypeid-get).
        - `max_tickets_per_day` integer, required — The maximum number of tickets the rule may create per day. If exceeded, one final ticket will be created, explaining the limit was hit and link back to the responsible rule.
        - `project_id` string, uuid, required — The UUID of the case management project.
        - `target` 'jira' | 'case_management', required — The ticketing system to create tickets in.
      - `created_at` integer, required — The Unix timestamp in milliseconds when the rule was created.
      - `created_by` AutomationRuleCreatedBy, required — The user or Datadog system who created the rule.
        - `id` string, required — The actor's identifier (a user UUID or a system identifier).
        - `name` string, required — The name of the actor.
        - `type` 'user' | 'system', required — Whether the actor is a user or the Datadog system.
      - `enabled` boolean, required — Whether the ticket creation rule is enabled.
      - `modified_at` integer, required — The Unix timestamp in milliseconds when the rule was last modified.
      - `modified_by` AutomationRuleModifiedBy, required — The user or Datadog system who last modified the rule.
        - `id` string, required — The actor's identifier (a user UUID or a system identifier).
        - `name` string, required — The name of the actor.
        - `type` 'user' | 'system', required — Whether the actor is a user or the Datadog system.
      - `name` string, required — The name of the ticket creation rule.
      - `rule` AutomationRuleScope, required — Defines the scope of findings to which the automation rule applies.
        - `finding_types` SecurityFindingType[], required — The list of security finding types that the automation rule applies to.
        - `query` string — A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/).
    - `id` string, uuid, required — The ID of the ticket creation rule.
    - `type` 'ticket_creation_rules', required — The JSON:API type for ticket creation rules.

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `422` — Unprocessable Entity
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)