---
title: "Get event processing policy chain"
method: GET
path: "/v1/event-processing-policy/chains/{chain-id}"
tags: ["Event Processing Policy"]
---

# Get event processing policy chain

`GET /v1/event-processing-policy/chains/{chain-id}`

Retrieve a chain together with its rules in evaluation order. The returned `version` should be sent back unchanged when replacing the chain's rules to detect concurrent modifications.

## Path parameters

- `chain-id` integer, required

## Response `200`

Chain retrieved successfully

- EventProcessingPolicyChain — A rule chain. Chain 0 is the main chain, the entry point of event processing. Event processing enters another chain when a rule lists the chain's ID in `chainCalls`; a "stop processing" rule inside the chain ends processing of the event, otherwise evaluation continues after the calling rule.
  - `id` integer — Chain ID (0 = main chain)
  - `guid` string, uuid — Chain GUID (used only in configuration export files, where numeric IDs would not be portable)
  - `name` string — Chain name
  - `description` string — Chain description
  - `version` integer — Chain version, incremented on every change of its rules. Send this value back when replacing the chain's rules to detect concurrent modifications.
  - `accessList` EventProcessingPolicyChainAccessElement[] — Chain-level access control list for users without the global EPP right (always empty for the main chain). Present only in responses to users with the global EPP right.
    - `userId` integer — User or group ID (groups have bit 30 set)
    - `accessRights` integer — Access rights bitmask: 0x0001 read chain, 0x0002 edit chain rules
  - `effectiveRights` integer — Rights of the requesting user on this chain as a bit mask (1 = read, 2 = edit). Users with the global EPP right have both on every chain.
  - `ruleCount` integer — Number of rules in the chain
  - `callerCount` integer — Number of rules (in any chain) calling this chain
  - `rules` EventProcessingPolicyRule[] — Chain rules in evaluation order (absent from the chain list)
    - `guid` string, uuid — Rule GUID. A new random GUID is generated on input if omitted.
    - `ruleNumber` integer — 1-based position of the rule in its chain (output only; ignored on input - array order is authoritative)
    - `errors` object, nullable — Errors detected in the rule by the server (output only; ignored on input). Broken references are reported but never removed automatically, because dropping the last source object from a rule's filter would silently turn it into a "match any object" rule. If rule has no errors this field is set to null.
      - `missingSourceObject` boolean — Rule refers to source objects or source exclusions that do not exist
      - `missingEvent` boolean — Rule refers to event templates that do not exist
      - `missingAction` boolean — Rule refers to server actions that do not exist
      - `missingAlarmCategory` boolean — Rule refers to alarm categories that do not exist
      - `filterScriptCompilationError` boolean — Filtering script cannot be compiled, so the rule matches all events that pass other filter conditions
      - `actionScriptCompilationError` boolean — Action script cannot be compiled and will not be executed
    - `chainId` integer — ID of the chain containing the rule, 0 for the main chain (output only; on input the rule belongs to the chain being updated)
    - `chainCalls` integer[] — IDs of chains entered when the rule matches, in order. Calls are made after the rule's own actions; a call to a chain that is already active for the event is skipped and reported by the SYS_EPP_CHAIN_LOOP event.
    - `flags` integer — Rule flags bitmask: 0x000001 stop processing, 0x000002 negated source match, 0x000004 negated event match, 0x000008 generate alarm, 0x000010 disabled, 0x000020 terminate alarms by regular expression, 0x000100..0x001000 match severity (info/warning/minor/major/critical), 0x002000 create helpdesk ticket, 0x004000 accept correlated events, 0x008000 negated time frame match, 0x010000 start downtime, 0x020000 end downtime, 0x040000 request AI comment, 0x080000 create incident, 0x100000 AI analyze incident, 0x200000 AI auto-assign incident
    - `sources` integer[] — Source object IDs the rule matches (empty = match any source)
    - `sourceExclusions` integer[] — Source object IDs explicitly excluded from matching
    - `events` integer[] — Event codes the rule matches (empty = match any event)
    - `timeFrames` object[] — Time frames during which the rule is active (empty = always active)
      - `time` integer — Time-of-day filter bitmask
      - `date` integer — Date filter bitmask (day of month / month / day of week)
    - `filterScript` string — NXSL filter script source; rule matches only if the script returns true
    - `alarmSeverity` integer — Severity of the generated alarm: 0=Normal, 1=Warning, 2=Minor, 3=Major, 4=Critical, 5=same as event, 6=terminate alarms, 7=resolve alarms
    - `alarmKey` string — Alarm key template (supports macro expansion)
    - `alarmMessage` string — Alarm message template (supports macro expansion)
    - `alarmImpact` string — Alarm impact description template
    - `alarmTimeout` integer — Alarm timeout in seconds (0 = no timeout)
    - `alarmTimeoutEvent` integer — Event code generated when the alarm times out
    - `alarmCategories` integer[] — Alarm category IDs assigned to the generated alarm
    - `alarmCategoryScript` string — Name of the library script returning alarm categories for the generated alarm (replaces alarmCategories when set)
    - `rootCauseAnalysisScript` string — Name of the library script used for root cause analysis
    - `actions` object[] — Server actions executed when the rule matches
      - `id` integer — Server action ID
      - `timerDelay` string — Delay before executing the action (seconds; supports macro expansion). Empty for immediate execution.
      - `timerKey` string — Timer key (supports macro expansion); used together with timerCancellations
      - `blockingTimerKey` string — Action is suppressed while a timer with this key is active
      - `snoozeTime` string — Minimum interval between repeated executions (seconds; supports macro expansion)
      - `active` boolean — Whether the action is enabled
    - `timerCancellations` string[] — Timer keys to cancel when the rule matches
    - `actionScript` string — NXSL action script executed when the rule matches
    - `pstorageSetActions` object — Persistent storage entries to set (key/value pairs; values support macro expansion)
    - `pstorageDeleteActions` string[] — Persistent storage keys to delete
    - `customAttributeSetActions` object — Custom attributes to set on the source object (key/value pairs; values support macro expansion)
    - `customAttributeDeleteActions` string[] — Custom attribute names to delete from the source object
    - `downtimeTag` string — Downtime tag used when starting or ending maintenance downtime
    - `incidentDelay` integer — Delay in seconds before an incident is created (0 = immediate)
    - `incidentTitle` string — Incident title template (empty = use alarm message)
    - `incidentDescription` string — Incident description template
    - `incidentAIAnalysisDepth` integer — Depth of AI incident analysis (0=quick, 1=standard, 2=thorough)
    - `incidentAIPrompt` string — Custom AI analysis instructions for the incident
    - `aiAgentInstructions` string — Instructions for the AI agent when generating an alarm comment
    - `comments` string — Rule description

## Other responses

- `400` — Chain ID is not a number
- `401` — Unauthorized
- `403` — User cannot read this chain - neither the global EPP right nor a read right from the chain access list
- `404` — Chain not found

## Changes

- **2026-09-09** `93009b998639` — 1 info
  - added the optional property `effectiveRights` to the response with the `200` status
- **2026-09-08** `4fd66f32833f` — 1 info
  - endpoint added
- **2026-09-08** `c2492179ed18` — 1 breaking
  - api path removed without deprecation
- **2026-09-07** `3aeada4e28f8` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/netxms/apis/netxms-api/changes/v1/event-processing-policy/chains/:chain-id/get.md)

---

[API](https://skmtc.dev/netxms/apis/netxms-api.md) · [All operations](https://skmtc.dev/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc.dev/netxms/apis/netxms-api/revisions/2827204d68d9?raw)