--- title: "Update Scanning Rule" method: PATCH path: "/api/v2/sensitive-data-scanner/config/rules/{rule_id}" tags: ["Sensitive Data Scanner"] --- # Update Scanning Rule `PATCH /api/v2/sensitive-data-scanner/config/rules/{rule_id}` ## Request - Base URL: `https://api.datadoghq.com` - URL: `https://api.datadoghq.com/api/v2/sensitive-data-scanner/config/rules/{rule_id}` - Auth: API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY` Update a scanning rule. The request body MUST NOT include a standard_pattern relationship, as that relationship is non-editable. Trying to edit the regex attribute of a rule with a standard_pattern relationship will also result in an error. ## Path parameters - `rule_id` string, required ## Request body - SensitiveDataScannerRuleUpdateRequest: Update rule request. - `data` SensitiveDataScannerRuleUpdate, required: Data related to the update of a rule. - `attributes` SensitiveDataScannerRuleAttributes: Attributes of the Sensitive Data Scanner rule. - `description` string: Description of the rule. - `excluded_namespaces` string[]: Attributes excluded from the scan. If namespaces is provided, it has to be a sub-path of the namespaces array. - `included_keyword_configuration` SensitiveDataScannerIncludedKeywordConfiguration: Object defining a set of keywords and a number of characters that help reduce noise. You can provide a list of keywords you would like to check within a defined proximity of the matching pattern. If any of the keywords are found within the proximity check, the match is kept. If none are found, the match is discarded. - `character_count` integer, required: The number of characters behind a match detected by Sensitive Data Scanner to look for the keywords defined. `character_count` should be greater than the maximum length of a keyword defined for a rule. - `keywords` string[], required: Keyword list that will be checked during scanning in order to validate a match. The number of keywords in the list must be less than or equal to 30. - `use_recommended_keywords` boolean: Should the rule use the underlying standard pattern keyword configuration. If set to `true`, the rule must be tied to a standard pattern. If set to `false`, the specified keywords and `character_count` are applied. - `is_enabled` boolean: Whether or not the rule is enabled. - `name` string: Name of the rule. - `namespaces` string[]: Attributes included in the scan. If namespaces is empty or missing, all attributes except excluded_namespaces are scanned. If both are missing the whole event is scanned. - `pattern` string: Not included if there is a relationship to a standard pattern. - `priority` integer: Integer from 1 (high) to 5 (low) indicating rule issue severity. - `suppressions` SensitiveDataScannerSuppressions: Object describing the suppressions for a rule. There are three types of suppressions, `starts_with`, `ends_with`, and `exact_match`. Suppressed matches are not obfuscated, counted in metrics, or displayed in the Findings page. - `ends_with` string[]: List of strings to use for suppression of matches ending with these strings. - `exact_match` string[]: List of strings to use for suppression of matches exactly matching these strings. - `starts_with` string[]: List of strings to use for suppression of matches starting with these strings. - `tags` string[]: List of tags. - `text_replacement` SensitiveDataScannerTextReplacement: Object describing how the scanned event will be replaced. - `number_of_chars` integer: Required if type == 'partial_replacement_from_beginning' or 'partial_replacement_from_end'. It must be > 0. - `replacement_string` string: Required if type == 'replacement_string'. - `should_save_match` boolean: Only valid when type == `replacement_string`. When enabled, matches can be unmasked in logs by users with ‘Data Scanner Unmask’ permission. As a security best practice, avoid masking for highly-sensitive, long-lived data. - `type` 'none' | 'hash' | 'replacement_string' | 'partial_replacement_from_beginning' | 'partial_replacement_from_end': Type of the replacement text. None means no replacement. hash means the data will be stubbed. replacement_string means that one can chose a text to replace the data. partial_replacement_from_beginning allows a user to partially replace the data from the beginning, and partial_replacement_from_end on the other hand, allows to replace data from the end. - `id` string: ID of the rule. - `relationships` SensitiveDataScannerRuleRelationships: Relationships of a scanning rule. - `group` SensitiveDataScannerGroupData: A scanning group data. - `data` SensitiveDataScannerGroup: A scanning group. - `id` string: ID of the group. - `type` 'sensitive_data_scanner_group': Sensitive Data Scanner group type. - `standard_pattern` SensitiveDataScannerStandardPatternData: A standard pattern. - `data` SensitiveDataScannerStandardPattern: Data containing the standard pattern id. - `id` string: ID of the standard pattern. - `type` 'sensitive_data_scanner_standard_pattern': Sensitive Data Scanner standard pattern type. - `type` 'sensitive_data_scanner_rule': Sensitive Data Scanner rule type. - `meta` SensitiveDataScannerMetaVersionOnly, required: Meta payload containing information about the API. - `version` integer: Version of the API (optional). ## Response `200` OK - SensitiveDataScannerRuleUpdateResponse: Update rule response. - `meta` SensitiveDataScannerMetaVersionOnly: Meta payload containing information about the API. - `version` integer: Version of the API (optional). ## Other responses - `400`: Bad Request - `403`: Authentication Error - `404`: Not Found - `429`: Too many requests --- [API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)