---
title: "This endpoint is used for getting a health monitoring rule."
method: GET
path: "/healthmonitoring/rules/{id}"
tags: ["Monitoring and Alerting"]
---

# This endpoint is used for getting a health monitoring rule.

`GET /healthmonitoring/rules/{id}`

## Request

- Base URL: `https://console.jumpcloud.com/api/v2`
- URL: `https://console.jumpcloud.com/api/v2/healthmonitoring/rules/{id}`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/docs/healthmonitoring/rules/:id/get.ts> (a function with typed inputs; its response is checked against the schema)

This endpoint allows you get a health monitoring rule.

## Path parameters

- `id` string, byte, required

## Response `200`

A successful response.

- JumpcloudHealthmonitoringGetRuleResponse: GetRuleResponse is the response to the GetRuleRequest.
  - `rule` JumpcloudHealthmonitoringRule: Rule represents a rule resource.
    - `alertFrequencySettings` JumpcloudHealthmonitoringAlertFrequencySettings: AlertFrequencySettings configures N-in-T alert frequency for a rule. monitoring_window is required when event_threshold_count > 1.
      - `countPerResource` boolean: When true, count events per resource grouping key; false = org-wide default.
      - `enabled` boolean: Master toggle for threshold-based alerting. When false or unset, the rule fires on every matching event. When true, N-in-T threshold logic applies.
      - `eventThresholdCount` integer: Minimum matching events (N) before alert fires. Unset or 1 = fire on first match.
      - `monitoringWindow` JumpcloudHealthmonitoringMonitoringWindow: MonitoringWindow is the rolling window duration for N-in-T alert frequency. Required when event_threshold_count > 1. Normalized to seconds server-side; min 300s; max configurable.
        - `unit` string: Supported units: minutes, hours, days.
        - `value` integer
    - `alertsEnabled` boolean
    - `category` 'RULE_CATEGORY_UNSPECIFIED' | 'RULE_CATEGORY_DIRECTORY' | 'RULE_CATEGORY_SYSTEM' | 'RULE_CATEGORY_ADMIN' | 'RULE_CATEGORY_ACCESS' | 'RULE_CATEGORY_GENERAL' | 'RULE_CATEGORY_CUSTOM'
    - `conditions` JumpcloudHealthmonitoringRuleCondition[]
      - `eventType` string: event_type specifies the event on which the rule's conditions have to be matched.
      - `filters` object: filters specify how to filter event messages to match the conditions. Example: The example below is for matching policy_id in a rule with event_type: policy_result. Note that each rule has a specific set of filters supported. "filters":{ "resource.policy_id": { "match_type": "=", "value_type": "string", "value":"6661c734af8ad100010a2483", "type":"mandatory", "template_config_id":"664cbeded18e0095a00ba36a" } }. Match the "policy_id" field nested under the "resource" object of the incoming JSON message. This is an equal to match (specified in "match_type"), with the field type as string (specified in "value_type"). The value to be matched is specified in "value". Supported values for match_type are string fields - "contains", "contains_any", "not_contains", "regex", "match_all" integer fields - ">", ">=", "<", "<="
      - `objectId` string, byte
    - `conditionsRelation` 'LOGICAL_OPERATOR_UNSPECIFIED' | 'LOGICAL_OPERATOR_AND' | 'LOGICAL_OPERATOR_OR': LogicalOperator specifies logical operations. Used to combine rule conditions and filters in a logical manner. - LOGICAL_OPERATOR_UNSPECIFIED: No operator specified - LOGICAL_OPERATOR_AND: Combine operands using AND - LOGICAL_OPERATOR_OR: Combine operands using OR
    - `createdAt` string, date-time
    - `createdBy` string
    - `createdByObjectId` string, byte
    - `description` string
    - `detectPreExistingAnamolies` boolean: Toggle to specify whether the alert should be produced for already existing anomalies when the rule is created or the rule applies to future violations.
    - `eventFilters` JumpcloudHealthmonitoringRuleEventFilter[]
      - `createdAt` string, date-time
      - `eventTypes` string[]
      - `filterSource` 'FILTER_SOURCE_UNSPECIFIED' | 'FILTER_SOURCE_UI_BUILDER' | 'FILTER_SOURCE_EXPR_BUILDER': FilterSource indicates the source or method used to create the filter for a rule. This helps track whether filters were created using the UI-based builder interface or through direct expression syntax. - FILTER_SOURCE_UNSPECIFIED: No filter source specified. - FILTER_SOURCE_UI_BUILDER: Filter was created using the UI-based builder interface. This typically involves using form fields, dropdowns, and visual components to construct the filter criteria. - FILTER_SOURCE_EXPR_BUILDER: Filter was created using the expression builder with direct syntax. This allows advanced users to write filter expressions directly, providing more flexibility and complex filtering capabilities.
      - `objectId` string, byte
      - `referenceFields` string[]
      - `resolutionCondition` string
      - `updatedAt` string, date-time
      - `violationCondition` string
    - `eventType` string: Supported values for event_type are policy_result command_result software_status_update user_create user_admin_granted user_group_admin_grant software_add software_remove device_inactive device_metrics_uptime_sample device_metrics_disk_usage_sample device_metrics_battery_sample.
    - `excludeSuspendedUsers` boolean
    - `groupObjectIds` string[]: JumpCloud device (system) and user group object IDs for rule scope. Replaces existing bindings when sent on update.
    - `labels` 'RULE_LABEL_UNSPECIFIED' | 'RULE_LABEL_ADMIN' | 'RULE_LABEL_WORKFLOW': RuleLabel indicates which service or surface created the rule. - RULE_LABEL_UNSPECIFIED: No label specified; defaults to admin behaviour. - RULE_LABEL_ADMIN: Rule was created through the Admin UI. - RULE_LABEL_WORKFLOW: Rule was created by the Workflow service.
    - `lastUpdatedAt` string, date-time
    - `lastUpdatedBy` string
    - `name` string
    - `notificationChannelObjectIds` string[]: List of notification channels to which the notification should be sent when the rule is violated.
    - `notifyOnAcknowledgement` boolean: Toggle to specify whether the notification should be produced for the acknowledgement of the alert.
    - `notifyOnResolution` boolean: Toggle to specify whether the notification should be produced for the resolution of the rule.
    - `notifyOnViolation` boolean: Toggle to specify whether the notification should be produced for the violation of the rule.
    - `notifyPrimaryUserOfDevice` boolean: When true, an extra notification to the device's primary user may be sent in addition to configured notification channels.
    - `objectId` string, byte
    - `organizationObjectId` string, byte
    - `osFamily` 'RULE_OS_FAMILY_UNSPECIFIED' | 'RULE_OS_FAMILY_ALL' | 'RULE_OS_FAMILY_WINDOWS' | 'RULE_OS_FAMILY_DARWIN' | 'RULE_OS_FAMILY_LINUX': RuleOsFamily specifies the OS family for a rule. Currently not being used. - RULE_OS_FAMILY_UNSPECIFIED: No OS family specified - RULE_OS_FAMILY_ALL: Rule applies to all supported OS families - RULE_OS_FAMILY_WINDOWS: Rule applies to windows OS family - RULE_OS_FAMILY_DARWIN: Rule applies to darwin OS family - RULE_OS_FAMILY_LINUX: Rule applies to linux OS family
    - `pollConditions` JumpcloudHealthmonitoringPollRuleCondition[]
      - `enabled` boolean
      - `objectId` string, byte
      - `thresholdValue` integer
    - `postExpiryEnabled` boolean
    - `ruleSubtype` string: Template variant for rule_type. Required on create when using rule_type instead of template_object_id (poll-based rules today). Supported values (with rule_type = RULE_TYPE_POLL_BASED): - certificate_expiry_detection — certificate expiration monitoring - device_policy_detection — device with no JumpCloud policy Omit for RULE_TYPE_TEMPLATE_BASED and RULE_TYPE_EVENT_FILTER_BASED. List GET /api/v2/healthmonitoring/ruletemplates for the current catalog.
    - `ruleType` 'RULE_TYPE_UNSPECIFIED' | 'RULE_TYPE_TEMPLATE_BASED' | 'RULE_TYPE_EVENT_FILTER_BASED' | 'RULE_TYPE_POLL_BASED': RuleType specifies the type of rule. - RULE_TYPE_UNSPECIFIED: No rule type specified. - RULE_TYPE_TEMPLATE_BASED: Template-based rules; omit rule_subtype and set template_object_id. - RULE_TYPE_EVENT_FILTER_BASED: Insights rules; omit rule_subtype and set event_filters. - RULE_TYPE_POLL_BASED: Poll-based rules; set rule_subtype (e.g. certificate_expiry_detection) or template_object_id.
    - `scopeType` string
    - `selectedScopeValues` string[]
    - `severity` 'RULE_SEVERITY_UNSPECIFIED' | 'RULE_SEVERITY_LOW' | 'RULE_SEVERITY_MEDIUM' | 'RULE_SEVERITY_HIGH' | 'RULE_SEVERITY_CRITICAL': RuleSeverity specifies the severity of a rule. This severity decides the severity of the produced alert. This allows the admin to assign different severities to alerts and helps prioritise the resolution. - RULE_SEVERITY_UNSPECIFIED: No severity specified. - RULE_SEVERITY_LOW: Severity of Low. - RULE_SEVERITY_MEDIUM: Severity of Medium. - RULE_SEVERITY_HIGH: Severity of High. - RULE_SEVERITY_CRITICAL: Severity of Critical — maps to Alert Priority critical level.
    - `status` 'RULE_STATUS_UNSPECIFIED' | 'RULE_STATUS_ENABLED' | 'RULE_STATUS_DISABLED': RuleStatus specifies the status of a rule. The status of the rule which can be either enabled or disabled. The rule is processed only in an enabled state. - RULE_STATUS_UNSPECIFIED: No status specified - RULE_STATUS_ENABLED: rule is enabled - RULE_STATUS_DISABLED: rule is disabled
    - `templateObjectId` string, byte: Identifies the rule template which is used to render the Rule configuration parameters via GUI. It is still a required parameter even when GUI is not used for configuring the rule. Identify the rule type and corresponding Rule template to fill this parameter during rule creation / updation Templates can be fetched using GET on /api/v2/healthmonitoring/ruletemplates. Please use the name field in the response to select appropriate rule template object ID to be used for configuring the rule.

---

[API](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2.md) - [All operations](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/llms.txt) - [OpenAPI document](https://skmtc.dev/jumpcloud/apis/jumpcloud-api-2/revisions/3f09fe63caaa?raw)