---
title: "Create a rule template"
method: POST
path: "/api/rule_templates/create/"
tags: ["Rule templates"]
---

# Create a rule template

`POST /api/rule_templates/create/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/rule_templates/create/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Creates a personal rule template owned by the caller. Items are validated exactly as machine rules are: source must be any/a built-in source name/a non-negative number, a non-empty event_pattern must be a valid regex (empty means all events), mode must be 1-4, and sanitize_scope must be any/unsanitized/sanitized/conditional/sanitized:<CLASS> (absent defaults to any); a mode 3 item with a sanitize_scope other than any is a 400. name is at most 128 bytes and description at most 512. Maximum 50 templates per user and 200 items per template. Names are unique per owner, case-insensitively. Cookie callers must pass CSRF.

This is a **write**: a read-only API key is refused with 403.

## Request body

- object
  - `name` string, required: Template name (unique per owner).
  - `description` string: Free-text description.
  - `items` unknown[]: Rules: source, event_pattern, mode, sanitize_scope. Omitted or empty makes a template with no rules.
    - unknown

## Response `201`

Created.

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)