---
title: "Get event processing policy rule"
method: GET
path: "/v1/event-processing-policy/rules/{rule-guid}"
tags: ["Event Processing Policy"]
---

# Get event processing policy rule

`GET /v1/event-processing-policy/rules/{rule-guid}`

Retrieve a single event processing policy rule by its GUID.

## Path parameters

- `rule-guid` string, uuid, required

## Response `200`

Rule retrieved successfully

- EventProcessingPolicyRule — A single event processing policy rule. On output, object and event references are plain numeric identifiers. On input, they may also be supplied as configuration export records (objects/events as nested objects carrying `name` and `guid`); such references are resolved by GUID or name.
  - `guid` string, uuid — Rule GUID. A new random GUID is generated on input if omitted.
  - `ruleNumber` integer — 1-based position of the rule in its chain (output only; ignored on input - array order is authoritative)
  - `errors` object, nullable — Errors detected in the rule by the server (output only; ignored on input). Broken references are reported but never removed automatically, because dropping the last source object from a rule's filter would silently turn it into a "match any object" rule. If rule has no errors this field is set to null.
    - `missingSourceObject` boolean — Rule refers to source objects or source exclusions that do not exist
    - `missingEvent` boolean — Rule refers to event templates that do not exist
    - `missingAction` boolean — Rule refers to server actions that do not exist
    - `missingAlarmCategory` boolean — Rule refers to alarm categories that do not exist
    - `filterScriptCompilationError` boolean — Filtering script cannot be compiled, so the rule matches all events that pass other filter conditions
    - `actionScriptCompilationError` boolean — Action script cannot be compiled and will not be executed
  - `chainId` integer — ID of the chain containing the rule, 0 for the main chain (output only; on input the rule belongs to the chain being updated)
  - `chainCalls` integer[] — IDs of chains entered when the rule matches, in order. Calls are made after the rule's own actions; a call to a chain that is already active for the event is skipped and reported by the SYS_EPP_CHAIN_LOOP event.
  - `flags` integer — Rule flags bitmask: 0x000001 stop processing, 0x000002 negated source match, 0x000004 negated event match, 0x000008 generate alarm, 0x000010 disabled, 0x000020 terminate alarms by regular expression, 0x000100..0x001000 match severity (info/warning/minor/major/critical), 0x002000 create helpdesk ticket, 0x004000 accept correlated events, 0x008000 negated time frame match, 0x010000 start downtime, 0x020000 end downtime, 0x040000 request AI comment, 0x080000 create incident, 0x100000 AI analyze incident, 0x200000 AI auto-assign incident
  - `sources` integer[] — Source object IDs the rule matches (empty = match any source)
  - `sourceExclusions` integer[] — Source object IDs explicitly excluded from matching
  - `events` integer[] — Event codes the rule matches (empty = match any event)
  - `timeFrames` object[] — Time frames during which the rule is active (empty = always active)
    - `time` integer — Time-of-day filter bitmask
    - `date` integer — Date filter bitmask (day of month / month / day of week)
  - `filterScript` string — NXSL filter script source; rule matches only if the script returns true
  - `alarmSeverity` integer — Severity of the generated alarm: 0=Normal, 1=Warning, 2=Minor, 3=Major, 4=Critical, 5=same as event, 6=terminate alarms, 7=resolve alarms
  - `alarmKey` string — Alarm key template (supports macro expansion)
  - `alarmMessage` string — Alarm message template (supports macro expansion)
  - `alarmImpact` string — Alarm impact description template
  - `alarmTimeout` integer — Alarm timeout in seconds (0 = no timeout)
  - `alarmTimeoutEvent` integer — Event code generated when the alarm times out
  - `alarmCategories` integer[] — Alarm category IDs assigned to the generated alarm
  - `alarmCategoryScript` string — Name of the library script returning alarm categories for the generated alarm (replaces alarmCategories when set)
  - `rootCauseAnalysisScript` string — Name of the library script used for root cause analysis
  - `actions` object[] — Server actions executed when the rule matches
    - `id` integer — Server action ID
    - `timerDelay` string — Delay before executing the action (seconds; supports macro expansion). Empty for immediate execution.
    - `timerKey` string — Timer key (supports macro expansion); used together with timerCancellations
    - `blockingTimerKey` string — Action is suppressed while a timer with this key is active
    - `snoozeTime` string — Minimum interval between repeated executions (seconds; supports macro expansion)
    - `active` boolean — Whether the action is enabled
  - `timerCancellations` string[] — Timer keys to cancel when the rule matches
  - `actionScript` string — NXSL action script executed when the rule matches
  - `pstorageSetActions` object — Persistent storage entries to set (key/value pairs; values support macro expansion)
  - `pstorageDeleteActions` string[] — Persistent storage keys to delete
  - `customAttributeSetActions` object — Custom attributes to set on the source object (key/value pairs; values support macro expansion)
  - `customAttributeDeleteActions` string[] — Custom attribute names to delete from the source object
  - `downtimeTag` string — Downtime tag used when starting or ending maintenance downtime
  - `incidentDelay` integer — Delay in seconds before an incident is created (0 = immediate)
  - `incidentTitle` string — Incident title template (empty = use alarm message)
  - `incidentDescription` string — Incident description template
  - `incidentAIAnalysisDepth` integer — Depth of AI incident analysis (0=quick, 1=standard, 2=thorough)
  - `incidentAIPrompt` string — Custom AI analysis instructions for the incident
  - `aiAgentInstructions` string — Instructions for the AI agent when generating an alarm comment
  - `comments` string — Rule description

## Other responses

- `400` — Invalid rule GUID
- `401` — Unauthorized
- `403` — User cannot read the chain the rule belongs to
- `404` — Rule not found

## Changes

- **2026-09-08** `4fd66f32833f` — 2 info
  - added the optional property `chainCalls` to the response with the `200` status
  - added the optional property `chainId` to the response with the `200` status
- **2026-09-08** `c2492179ed18` — 2 warning
  - removed the optional property `chainCalls` from the response with the `200` status
  - removed the optional property `chainId` from the response with the `200` status
- **2026-09-07** `3aeada4e28f8` — 2 info
  - added the optional property `chainCalls` to the response with the `200` status
  - added the optional property `chainId` to the response with the `200` status
- **2026-09-04** `4e1f9580c5b0` — 1 breaking
  - the response property `errors` became nullable for the status `200`
- **2026-09-04** `e1509f7b65d5` — 1 info
  - added the optional property `errors` to the response with the `200` status

[Full history](https://skmtc.dev/netxms/apis/netxms-api/changes/v1/event-processing-policy/rules/:rule-guid/get.md)

---

[API](https://skmtc.dev/netxms/apis/netxms-api.md) · [All operations](https://skmtc.dev/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc.dev/netxms/apis/netxms-api/revisions/d8d0c36484d6?raw)