---
title: "Update a machine rule"
method: PATCH
path: "/api/machine_rules/{id}/update/"
tags: ["Filters, rules and taint"]
---

# Update a machine rule

`PATCH /api/machine_rules/{id}/update/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/machine_rules/{id}/update/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Partially updates a rule by id (path); only keys present in the JSON body change. Same validation/gates as create: polarity in {whitelist,blacklist}, mode 1-4 (3/Raise requires the raise grant, admins always allowed), event_pattern a valid regex, source any, a built-in source name or a non-negative number (open to every user), sanitize_scope one of the values create accepts, and a rule that would end up as mode 3 with a sanitize_scope other than any, or with a match key, is a 400. A rule's match_on cannot be changed here. Changing mode re-normalizes the stored polarity to match it. 404 if not owned by the caller. Cookie callers must pass CSRF.

This is a **write**: a read-only API key is refused with 403.

## Path parameters

- `id` integer, required

## Request body

- object
  - `polarity` string: whitelist or blacklist.
  - `event_pattern` string, regex: Event-name regex; empty means all events.
  - `mode` integer: 1=hide, 2=show, 3=raise (requires the raise grant), 4=drop.
  - `label` string: Human label.
  - `enabled` boolean: Enable/disable the rule.
  - `source` string: Taint-source scope: any, a built-in source name, or a non-negative number.
  - `sanitize_scope` string: any, unsanitized, sanitized, conditional, or sanitized:<class>.

## Response `200`

OK.

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)