---
title: "Create an incident rule"
method: POST
path: "/api/v2/incidents/config/rules"
tags: ["Incidents"]
---

# Create an incident rule

`POST /api/v2/incidents/config/rules`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/incidents/config/rules`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `incident_settings_write`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/incidents/config/rules/post.ts> (a function with typed inputs; its response is checked against the schema)

Create an incident rule.

## Request body

- IncidentRuleRequest: Request payload for creating an incident rule.
  - `data` IncidentRuleDataRequest, required: Incident rule data in a create request.
    - `attributes` IncidentRuleDataAttributesRequest, required: Attributes for creating an incident rule.
      - `condition` IncidentRuleQueryCondition, required: A query-based condition for an incident rule.
        - `normalized_query` string, nullable: The normalized query string.
        - `raw_query` string, nullable: The raw query string.
      - `condition_table_type` integer, required: The condition table type. 1 = raw query.
      - `conditions` IncidentRuleCondition[]: List of field-based conditions.
        - `field` string, required: The field to match on.
        - `values` string[], required: The values to match.
      - `enabled` boolean, required: Whether the rule is enabled.
      - `execution_type` 1 | 2, required: The execution type of an incident rule.
      - `incident_type_uuid` string, uuid, nullable: The UUID of the incident type this rule applies to.
      - `match_any_condition` boolean: Whether any condition (OR logic) should match instead of all (AND logic).
      - `task_id` 'jira-create-issue-job' | 'notify-incident-handles-job' | 'servicenow-create-incident-job' | 'slack-create-channel-job' | 'zoom-create-meeting-job' | 'google-meet-create-meeting-job' | 'workflow-automation-job' | 'ms-teams-create-meeting-job' | 'google-chat-create-space-job' | 'zoom-suppress-summarization-job' | 'ms-teams-suppress-summarization-job' | 'google-meet-suppress-summarization-job', required: The task ID for an incident rule.
      - `task_payload` string, required: The JSON-encoded payload for the task.
      - `trigger` 'incident_saved_trigger' | 'incident_created_trigger' | 'incident_modified_trigger': The trigger event for an incident rule.
    - `type` 'incident_rules', required: Incident rule resource type.

## Response `201`

Created

- IncidentRuleResponse: Response with a single incident rule.
  - `data` IncidentRuleDataResponse, required: Incident rule data in a response.
    - `attributes` IncidentRuleDataAttributesResponse, required: Attributes of an incident rule in a response.
      - `condition` IncidentRuleQueryCondition: A query-based condition for an incident rule.
        - `normalized_query` string, nullable: The normalized query string.
        - `raw_query` string, nullable: The raw query string.
      - `condition_table_type` integer: The condition table type.
      - `conditions` IncidentRuleCondition[]: List of field-based conditions.
        - `field` string, required: The field to match on.
        - `values` string[], required: The values to match.
      - `created` string, date-time: Timestamp when the rule was created.
      - `created_by_uuid` string, uuid: UUID of the user who created the rule.
      - `deleted` string, date-time, nullable: Timestamp when the rule was deleted.
      - `enabled` boolean: Whether the rule is enabled.
      - `execution_type` integer: The execution type of the rule.
      - `incident_settings_association_uuid` string, uuid, nullable: The incident settings association UUID.
      - `match_any_condition` boolean: Whether any condition should match.
      - `modified` string, date-time: Timestamp when the rule was last modified.
      - `modified_by_uuid` string, uuid: UUID of the user who last modified the rule.
      - `org_id` integer: The organization ID.
      - `task_id` string, nullable: The task ID.
      - `task_payload` string, nullable: The JSON-encoded task payload.
      - `trigger` string: The trigger event for the rule.
    - `id` string, uuid, required: The rule identifier.
    - `type` 'incidents_rules', required: Incident rule response resource type.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)