---
title: "Get a rule proposal"
method: GET
path: "/api/v2/security_monitoring/rules/proposals/{proposal_id}"
tags: ["Security Monitoring"]
---

# Get a rule proposal

`GET /api/v2/security_monitoring/rules/proposals/{proposal_id}`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/rules/proposals/{proposal_id}`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_rules_read`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/security_monitoring/rules/proposals/:proposal_id/get.ts> (a function with typed inputs; its response is checked against the schema)

Get the status of a rule proposal started with the start-a-rule-proposal endpoint.
While the status is `pending` or `in_progress`, the proposed rule is still being
generated. Poll this endpoint again later. If the status is `completed`, the response's `rule` field contains
the proposed Cloud SIEM detection rule. If the status is `failed`, the response's `error` field contains
the reason a rule could not be generated.

This endpoint does not create or modify any detection rules in Cloud SIEM. To create the
proposed rule, use the create-a-detection-rule endpoint.

## Path parameters

- `proposal_id` string, uuid, required

## Response `200`

OK

- SecurityMonitoringRuleProposalResponse: Response containing a rule proposal.
  - `data` SecurityMonitoringRuleProposalResponseData, required: Data of the rule proposal.
    - `attributes` SecurityMonitoringRuleProposalResponseAttributes, required: Attributes of the rule proposal.
      - `error` SecurityMonitoringRuleProposalError: The reason no rule could be generated. Only present when the status is `failed`.
        - `kind` string, required: The kind of failure. - `translation_error`: no rule could be generated from the input. Reword the input or add details, then start a new rule proposal. - `internal_error`: the proposal failed because of an internal error. Start a new rule proposal to try again.
        - `message` string: A human-readable explanation of why no rule could be generated, when available.
        - `type` string: The type of failure within its kind, such as `NoRuleProduced`.
      - `rule` object: The proposed Cloud SIEM detection rule in the same format as the create a detection rule endpoint. It is not saved in Cloud SIEM. Only present when the status is `completed`. Review the rule, then create it with the [create a detection rule](https://docs.datadoghq.com/api/latest/security-monitoring/#create-a-detection-rule) endpoint.
      - `status` string, required: The status of the rule proposal. `pending` and `in_progress` mean the proposed rule is still being generated. Poll the endpoint again later. `completed` and `failed` are final: `completed` proposals contain the proposed rule in `rule`, and `failed` proposals contain the reason in `error`.
    - `id` string, uuid, required: The ID of the rule proposal.
    - `type` 'rule_proposals', required: The rule proposal resource type. The value is always `rule_proposals`.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)