---
title: "Create a severity modifier rule"
method: POST
path: "/api/v2/security/findings/automation/severity_modifier_rules"
tags: ["Security Monitoring"]
---

# Create a severity modifier rule

`POST /api/v2/security/findings/automation/severity_modifier_rules`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security/findings/automation/severity_modifier_rules`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/security/findings/automation/severity_modifier_rules/post.ts> (a function with typed inputs; its response is checked against the schema)

Create a severity modifier rule for the current organization.

## Request body

- SeverityModifierRuleCreateRequest: The body of a severity modifier rule create request.
  - `data` SeverityModifierRuleDataCreate, required: The data object for a severity modifier rule create request.
    - `attributes` SeverityModifierRuleAttributesCreate, required: Attributes for creating or updating a severity modifier rule.
      - `action` union, required: The action to take when a severity modifier rule matches a finding. This is a discriminated union on `type`: `set` assigns a fixed severity, while `shift` moves the severity up or down by one rank. A severity modifier rule's `rule.query` must not filter on `@severity` or on the `@severity_details.user_adjusted.*` namespace. Use `@severity_details.adjusted.value` instead, which reflects the severity before user-defined adjustments.
        - SeverityModifierRuleSetAction: Sets matched findings to a fixed severity.
          - `description` string: An optional free-form explanation for the severity change.
          - `severity` 'info_none' | 'low' | 'medium' | 'high' | 'critical', required: The severity to assign to matched findings. `info_none` is not supported for the `iac_misconfiguration`, `runtime_code_vulnerability`, `secret`, or `static_code_vulnerability` finding types.
          - `type` 'set', required: The type of a severity modifier rule action that sets a fixed severity.
        - SeverityModifierRuleShiftAction: Shifts matched findings up or down by one severity rank.
          - `description` string: An optional free-form explanation for the severity change.
          - `severity_delta` 'up_one' | 'down_one', required: The direction in which to shift the severity of matched findings by one rank.
          - `type` 'shift', required: The type of a severity modifier rule action that shifts the severity by one rank.
      - `enabled` boolean: Whether the severity modifier rule is enabled.
      - `name` string, required: The name of the severity modifier rule.
      - `rule` AutomationRuleScope, required: Defines the scope of findings to which the automation rule applies.
        - `finding_types` SecurityFindingType[], required: The list of security finding types that the automation rule applies to.
        - `query` string: A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/).
    - `type` 'severity_modifier_rules', required: The JSON:API type for severity modifier rules.

## Response `201`

Successfully created the severity modifier rule

- SeverityModifierRuleResponse: A single severity modifier rule response.
  - `data` SeverityModifierRuleDataResponse, required: The data object for a severity modifier rule as returned by the API.
    - `attributes` SeverityModifierRuleAttributesResponse, required: Attributes of a severity modifier rule as returned by the API.
      - `action` union, required: The action to take when a severity modifier rule matches a finding. This is a discriminated union on `type`: `set` assigns a fixed severity, while `shift` moves the severity up or down by one rank. A severity modifier rule's `rule.query` must not filter on `@severity` or on the `@severity_details.user_adjusted.*` namespace. Use `@severity_details.adjusted.value` instead, which reflects the severity before user-defined adjustments.
        - SeverityModifierRuleSetAction: Sets matched findings to a fixed severity.
          - `description` string: An optional free-form explanation for the severity change.
          - `severity` 'info_none' | 'low' | 'medium' | 'high' | 'critical', required: The severity to assign to matched findings. `info_none` is not supported for the `iac_misconfiguration`, `runtime_code_vulnerability`, `secret`, or `static_code_vulnerability` finding types.
          - `type` 'set', required: The type of a severity modifier rule action that sets a fixed severity.
        - SeverityModifierRuleShiftAction: Shifts matched findings up or down by one severity rank.
          - `description` string: An optional free-form explanation for the severity change.
          - `severity_delta` 'up_one' | 'down_one', required: The direction in which to shift the severity of matched findings by one rank.
          - `type` 'shift', required: The type of a severity modifier rule action that shifts the severity by one rank.
      - `created_at` integer, required: The Unix timestamp in milliseconds when the rule was created.
      - `created_by` AutomationRuleCreatedBy, required: The user or Datadog system who created the rule.
        - `id` string, required: The actor's identifier (a user UUID or a system identifier).
        - `name` string, required: The name of the actor.
        - `type` 'user' | 'system', required: Whether the actor is a user or the Datadog system.
      - `enabled` boolean, required: Whether the severity modifier rule is enabled.
      - `modified_at` integer, required: The Unix timestamp in milliseconds when the rule was last modified.
      - `modified_by` AutomationRuleModifiedBy, required: The user or Datadog system who last modified the rule.
        - `id` string, required: The actor's identifier (a user UUID or a system identifier).
        - `name` string, required: The name of the actor.
        - `type` 'user' | 'system', required: Whether the actor is a user or the Datadog system.
      - `name` string, required: The name of the severity modifier rule.
      - `rule` AutomationRuleScope, required: Defines the scope of findings to which the automation rule applies.
        - `finding_types` SecurityFindingType[], required: The list of security finding types that the automation rule applies to.
        - `query` string: A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/).
    - `id` string, uuid, required: The ID of the severity modifier rule.
    - `type` 'severity_modifier_rules', required: The JSON:API type for severity modifier rules.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `422`: Unprocessable Entity
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)