---
title: "Create a due date rule"
method: POST
path: "/api/v2/security/findings/automation/due_date_rules"
tags: ["Security Monitoring"]
---

# Create a due date rule

`POST /api/v2/security/findings/automation/due_date_rules`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security/findings/automation/due_date_rules`
- Auth: API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`

Create a new due date rule for the current organization.

## Request body

- DueDateRuleCreateRequest: The body of a due date rule create request.
  - `data` DueDateRuleDataCreate, required: The data object for a due date rule create or update request.
    - `attributes` DueDateRuleAttributesCreate, required: Attributes for creating or updating a due date rule.
      - `action` DueDateRuleAction, required: The action to take when the due date rule matches a finding.
        - `due_days_per_severity` DueDatePerSeverityItem[], required: A list of severity-to-due-date mappings. Each severity may appear at most once.
          - `due_in_days` integer, required: The number of days from the reference point until the finding is due.
          - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info' | 'none' | 'unknown', required: A severity level used to configure due date thresholds.
        - `due_from` 'first_seen' | 'fix_available', required: The reference point from which the due date is calculated. When `fix_available` is selected but not applicable to the finding type, `first_seen` is used instead.
        - `reason_description` string: An optional description providing more context for the due date assignment.
      - `enabled` boolean: Whether the due date rule is enabled.
      - `name` string, required: The name of the due date rule.
      - `rule` AutomationRuleScope, required: Defines the scope of findings to which the automation rule applies.
        - `finding_types` SecurityFindingType[], required: The list of security finding types that the automation rule applies to.
        - `query` string: A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/).
    - `type` 'due_date_rules', required: The JSON:API type for due date rules.

## Response `201`

Successfully created the due date rule

- DueDateRuleResponse: A single due date rule response.
  - `data` DueDateRuleDataResponse, required: The data object for a due date rule returned by the API.
    - `attributes` DueDateRuleAttributesResponse, required: Attributes of a due date rule returned by the API.
      - `action` DueDateRuleAction, required: The action to take when the due date rule matches a finding.
        - `due_days_per_severity` DueDatePerSeverityItem[], required: A list of severity-to-due-date mappings. Each severity may appear at most once.
          - `due_in_days` integer, required: The number of days from the reference point until the finding is due.
          - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info' | 'none' | 'unknown', required: A severity level used to configure due date thresholds.
        - `due_from` 'first_seen' | 'fix_available', required: The reference point from which the due date is calculated. When `fix_available` is selected but not applicable to the finding type, `first_seen` is used instead.
        - `reason_description` string: An optional description providing more context for the due date assignment.
      - `created_at` integer, required: The Unix timestamp in milliseconds when the rule was created.
      - `created_by` AutomationRuleCreatedBy, required: The user or Datadog system who created the rule.
        - `id` string, required: The actor's identifier (a user UUID or a system identifier).
        - `name` string, required: The name of the actor.
        - `type` 'user' | 'system', required: Whether the actor is a user or the Datadog system.
      - `enabled` boolean, required: Whether the due date rule is enabled.
      - `modified_at` integer, required: The Unix timestamp in milliseconds when the rule was last modified.
      - `modified_by` AutomationRuleModifiedBy, required: The user or Datadog system who last modified the rule.
        - `id` string, required: The actor's identifier (a user UUID or a system identifier).
        - `name` string, required: The name of the actor.
        - `type` 'user' | 'system', required: Whether the actor is a user or the Datadog system.
      - `name` string, required: The name of the due date rule.
      - `rule` AutomationRuleScope, required: Defines the scope of findings to which the automation rule applies.
        - `finding_types` SecurityFindingType[], required: The list of security finding types that the automation rule applies to.
        - `query` string: A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/).
    - `id` string, uuid, required: The ID of the due date rule.
    - `type` 'due_date_rules', required: The JSON:API type for due date rules.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `422`: Unprocessable Entity
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)