---
title: "Create an event filter"
method: POST
path: "/api/filters/create/"
tags: ["Filters, rules and taint"]
---

# Create an event filter

`POST /api/filters/create/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/filters/create/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Creates an event filter (JSON body). mode must be blacklist or whitelist; target defaults to where and may be where, origin, source or tag. A source target is available to admin accounts only (403 for every other account); where, origin and tag are open to everyone. engine defaults to any. enabled defaults to true. pattern is at most 512 characters and label at most 128. Returns 201 with the created filter. Cookie callers must pass CSRF.

This is a **write**: a read-only API key is refused with 403.

## Request body

- object
  - `pattern` string, required: Match pattern, at most 512 characters.
  - `label` string: Human label for the filter, at most 128 characters.
  - `mode` string, required: blacklist (hide matches) or whitelist (show only matches).
  - `target` string: where (default), origin, source or tag. source is admin-only; tag takes an impact class label as its pattern, and an unknown label is a 400.
  - `engine` string: The filters page this filter belongs to: any (default, every page) or one of python, browser, go, c, cpp, rust, node, solidity, java, bash, ruby or php. An engine your account does not hold is a 403.
  - `enabled` boolean: Whether the filter is active (default true).

## Response `201`

Created.

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)