---
title: "Create a machine rule"
method: POST
path: "/api/machine_rules/create/"
tags: ["Filters, rules and taint"]
---

# Create a machine rule

`POST /api/machine_rules/create/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/machine_rules/create/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Creates a rule (JSON body) in the given scope (machine = a machine public_id, '' = global). A rule only ever affects the events its event_pattern matches: 1 hides them from the list, 2 shows only them, 3 raises on them, 4 stops them being sent. mode defaults to 2 (Show) and must be 1-4 (mode 3/Raise requires the raise grant, admins always allowed; else 403); event_pattern (empty = all events) must be a valid regex; source defaults to any, and scoping a rule to a source is open to every user. polarity is vestigial: it is validated if supplied but the stored value always follows the mode (4 = blacklist, else whitelist). A Raise rule (mode 3) takes neither a sanitize_scope other than any nor a match_on: each is a 400. from_event makes the rule from one of your events; match_on or event_machine without it is a 400, and an event that is not yours is a 404. Returns 201 with the created rule. Cookie callers must pass CSRF.

This is a **write**: a read-only API key is refused with 403.

## Request body

- object
  - `machine` string: Machine public_id to scope to; omit/empty for global.
  - `polarity` string: whitelist or blacklist. Validated, then replaced by the value the mode implies.
  - `event_pattern` string, regex: Event-name regex; empty means all events (.*).
  - `mode` integer: 1=hide, 2=show (default), 3=raise (requires the raise grant), 4=drop.
  - `label` string: Human label for the rule.
  - `source` string: Taint-source scope: any (default), a built-in source name, or a non-negative number (your own source n). Anything else is a 400.
  - `sanitize_scope` string: Which events by sanitizer verdict the rule applies to: any (default), unsanitized, sanitized, conditional, or sanitized:<class>. Anything else is a 400.
  - `enabled` boolean: Whether the rule is active (default true).
  - `from_event` integer: An event id. Makes the rule from that event: an empty event_pattern becomes its sink, anchored.
  - `match_on` string[]: With from_event: any of source (the taint chain), trace, detail, origin. The rule then also requires those fields to equal the event's. An unknown name is a 400; not allowed with mode 3.
  - `event_machine` boolean: With from_event: true scopes the rule to the machine that sent the event, in place of machine.

## Response `201`

Created.

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)