---
title: "Set the unique-event definition"
method: PUT
path: "/api/event_uniqueness/"
tags: ["Filters, rules and taint"]
---

# Set the unique-event definition

`PUT /api/event_uniqueness/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/event_uniqueness/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Sets which fields split detections into separate events for the given scope. `axes` is any subset of source, detail, trace, machine, origin; an empty array keeps only the baseline (account, agent, sink); a name outside that list is ignored, not rejected. A product your account does not hold is a 400. OMITTING `axes` entirely clears this scope's row so it inherits the level below it; that is how you reset a machine to the account default. Applies to detections recorded from now on: it does not re-group what is already stored, and a field that was not keyed was never stored per-occurrence, so no later change can split history that has already merged. On success replies 204 No Content. Cookie callers must pass CSRF.

This is a **write**: a read-only API key is refused with 403.

## Request body

- object
  - `machine` string: Machine public_id to scope to; omit/empty for the account default.
  - `agent_kind` string, required: Product the setting applies to, e.g. python.
  - `axes` unknown[]: Subset of source, detail, trace, machine, origin. Omit to clear this scope.
    - unknown

## Response `204`

Done. No body.

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)