---
title: "Get all default inbox rules"
method: GET
path: "/api/v2/security/findings/automation/default_inbox_rules"
tags: ["Security Monitoring"]
---

# Get all default inbox rules

`GET /api/v2/security/findings/automation/default_inbox_rules`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security/findings/automation/default_inbox_rules`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/security/findings/automation/default_inbox_rules/get.ts> (a function with typed inputs; its response is checked against the schema)

Get all default inbox rules for the current organization.
Datadog manages default inbox rules. Their name, rule, and action are
read-only, and each organization can change only whether they are enabled.

## Response `200`

Successfully retrieved the list of default inbox rules

- DefaultInboxRulesResponse: A list of default inbox rules.
  - `data` DefaultInboxRuleDataResponse[], required: A list of default inbox rule data objects.
    - `attributes` DefaultInboxRuleAttributesResponse, required: Attributes of a default inbox rule returned by the API.
      - `action` InboxRuleAction, required: The action to take when the inbox rule matches a finding.
        - `description` string: An optional description providing more context for the rule.
      - `created_at` integer, required: The Unix timestamp in milliseconds when the rule definition was created. The definition is authored by Datadog.
      - `created_by` AutomationRuleCreatedBy, required: The user or Datadog system who created the rule.
        - `id` string, required: The actor's identifier (a user UUID or a system identifier).
        - `name` string, required: The name of the actor.
        - `type` 'user' | 'system', required: Whether the actor is a user or the Datadog system.
      - `enabled` boolean, required: Whether the default inbox rule is enabled for the organization.
      - `modified_at` integer, required: The Unix timestamp in milliseconds when the rule was last modified.
      - `modified_by` AutomationRuleModifiedBy, required: The user or Datadog system who last modified the rule.
        - `id` string, required: The actor's identifier (a user UUID or a system identifier).
        - `name` string, required: The name of the actor.
        - `type` 'user' | 'system', required: Whether the actor is a user or the Datadog system.
      - `name` string, required: The name of the default inbox rule.
      - `rule` AutomationRuleScope, required: Defines the scope of findings to which the automation rule applies.
        - `finding_types` SecurityFindingType[], required: The list of security finding types that the automation rule applies to.
        - `query` string: A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/).
    - `id` string, required: The ID of the default inbox rule. Known default rule IDs include: `identity_risk_default_rule`, `secret_default_rule`, `library_vulnerability_default_rule`, `attack_path_default_rule`, `host_and_container_vulnerability_default_rule`, `runtime_code_vulnerability_default_rule`, `iac_misconfiguration_default_rule`, and `misconfiguration_default_rule`. Datadog can add new default rules over time.
    - `type` 'default_inbox_rules', required: The JSON:API type for default inbox rules.

## Other responses

- `403`: Forbidden
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)