---
title: "Gets custom rules"
method: GET
path: "/1.1/protection/custom-rules"
tags: ["Custom rules"]
---

# Gets custom rules

`GET /1.1/protection/custom-rules`

## Request

- Base URL: `https://customer-api.datadome.co`
- URL: `https://customer-api.datadome.co/1.1/protection/custom-rules`
- Auth: API key in header `x-api-key`

## Query parameters

- `withoutTraffic` boolean

## Response `200`

Gets the defined custom rules, hits attribute is the number of requests who matched the rule from the last 24 hours.

- GetCustomRulesResponse
  - `data` CustomRuleResponseData
    - `custom_rules` CustomRule[]
      - `id` integer
      - `rule_name` string
      - `rule_response` 'allow' | 'captcha' | 'block' | 'device_check' | 'intent_based' | 'monetize': The configured response. A rule carrying a rate-limit or time-box policy returns its base response here ('allow' or 'intent_based'); the policy itself is exposed under 'policy_options'.
      - `rule_priority` string
      - `query` string
      - `endpoint_type` string
      - `hits` integer, nullable
      - `rule_enabled` boolean
      - `activated_at` string, nullable
      - `expired_at` string, nullable
      - `overridden_bot` object, nullable
        - `uuid` string
        - `name` string
      - `policy_options` PolicyOptions: Optional rate-limit or time-box policy applying to a custom rule. Max one policy can be provided. Only available when rule_response is 'allow' or 'intent_based'.
        - `time_box` TimeBoxOption: Time box policy option. Restricts the rule to specific hours of the week, applying an alternative response outside the authorized window.
          - `authorized_hours_of_the_week` integer[], required: List of authorized hour slots during the week. Each integer represents an hour index from 0 (Monday 00:00) to 167 (Sunday 23:00), covering all 168 possible hour intervals in a week.
          - `response_outside_time_box` 'block' | 'captcha' | 'device_check', required: The action taken for requests received outside the authorized hours.
        - `rate_limit` RateLimitOption: Rate limit policy option. Triggers an alternative response once a request threshold is exceeded within a time window. When the rule has an overridden_bot set, applies_to MUST be 'all_traffic'; using 'ip' or 'session' in that context will return a 400 error.
          - `applies_to` 'all_traffic' | 'ip' | 'session', required: Scope over which the rate is counted. Exactly one value must be chosen. 'ip' and 'session' are NOT allowed when the custom rule has an overridden_bot set — use 'all_traffic' in that case.
          - `threshold` integer, required: Maximum number of requests allowed within the defined time frame.
          - `time_frame` '1m' | '15m' | '1h' | '4h' | '1d', required: The time window over which the threshold is evaluated.
          - `response_after_threshold` 'block' | 'captcha' | 'device_check', required: The action taken once the threshold is exceeded.
  - `status` integer
  - `errors` string[]
  - `message` string

## Other responses

- `500`: Internal Server Error

---

[API](https://skmtc.dev/datadome/apis/management-api.md) - [All operations](https://skmtc.dev/datadome/apis/management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/datadome/apis/management-api/revisions/80062169b99e?raw)