---
title: "Replace chain rules"
method: PUT
path: "/v1/event-processing-policy/chains/{chain-id}/rules"
tags: ["Event Processing Policy"]
---

# Replace chain rules

`PUT /v1/event-processing-policy/chains/{chain-id}/rules`

Replace the rules of a chain (including the main chain, ID 0) with the supplied ordered list.
Other chains are not affected. If `version` is present in the request body it must match the
current chain version, otherwise the request is rejected with status 409 and the body contains
the current `currentVersion`. If `version` is omitted the chain is replaced unconditionally.

Each rule may be supplied either in the form produced by this API (object IDs, event codes,
and called chain IDs as plain integers) or as a configuration export record (object/event
references as objects carrying name and GUID, called chains as GUIDs); the latter form is
resolved on import and any references that cannot be resolved are dropped, with details
returned in the optional `warnings` field.

## Path parameters

- `chain-id` integer, required

## Request body

- EventProcessingPolicyUpdateRequest — Request body for replacing the rules of one chain
  - `version` integer — Expected current chain version. If present, the update is applied only if it matches the server-side version, otherwise the request is rejected with status 409. If omitted, the chain is replaced unconditionally.
  - `rules` EventProcessingPolicyRule[], required — New rule list in evaluation order (the chain's existing rules are fully replaced)
    - `guid` string, uuid — Rule GUID. A new random GUID is generated on input if omitted.
    - `ruleNumber` integer — 1-based position of the rule in its chain (output only; ignored on input - array order is authoritative)
    - `errors` object, nullable — Errors detected in the rule by the server (output only; ignored on input). Broken references are reported but never removed automatically, because dropping the last source object from a rule's filter would silently turn it into a "match any object" rule. If rule has no errors this field is set to null.
      - `missingSourceObject` boolean — Rule refers to source objects or source exclusions that do not exist
      - `missingEvent` boolean — Rule refers to event templates that do not exist
      - `missingAction` boolean — Rule refers to server actions that do not exist
      - `missingAlarmCategory` boolean — Rule refers to alarm categories that do not exist
      - `filterScriptCompilationError` boolean — Filtering script cannot be compiled, so the rule matches all events that pass other filter conditions
      - `actionScriptCompilationError` boolean — Action script cannot be compiled and will not be executed
    - `chainId` integer — ID of the chain containing the rule, 0 for the main chain (output only; on input the rule belongs to the chain being updated)
    - `chainCalls` integer[] — IDs of chains entered when the rule matches, in order. Calls are made after the rule's own actions; a call to a chain that is already active for the event is skipped and reported by the SYS_EPP_CHAIN_LOOP event.
    - `flags` integer — Rule flags bitmask: 0x000001 stop processing, 0x000002 negated source match, 0x000004 negated event match, 0x000008 generate alarm, 0x000010 disabled, 0x000020 terminate alarms by regular expression, 0x000100..0x001000 match severity (info/warning/minor/major/critical), 0x002000 create helpdesk ticket, 0x004000 accept correlated events, 0x008000 negated time frame match, 0x010000 start downtime, 0x020000 end downtime, 0x040000 request AI comment, 0x080000 create incident, 0x100000 AI analyze incident, 0x200000 AI auto-assign incident
    - `sources` integer[] — Source object IDs the rule matches (empty = match any source)
    - `sourceExclusions` integer[] — Source object IDs explicitly excluded from matching
    - `events` integer[] — Event codes the rule matches (empty = match any event)
    - `timeFrames` object[] — Time frames during which the rule is active (empty = always active)
      - `time` integer — Time-of-day filter bitmask
      - `date` integer — Date filter bitmask (day of month / month / day of week)
    - `filterScript` string — NXSL filter script source; rule matches only if the script returns true
    - `alarmSeverity` integer — Severity of the generated alarm: 0=Normal, 1=Warning, 2=Minor, 3=Major, 4=Critical, 5=same as event, 6=terminate alarms, 7=resolve alarms
    - `alarmKey` string — Alarm key template (supports macro expansion)
    - `alarmMessage` string — Alarm message template (supports macro expansion)
    - `alarmImpact` string — Alarm impact description template
    - `alarmTimeout` integer — Alarm timeout in seconds (0 = no timeout)
    - `alarmTimeoutEvent` integer — Event code generated when the alarm times out
    - `alarmCategories` integer[] — Alarm category IDs assigned to the generated alarm
    - `alarmCategoryScript` string — Name of the library script returning alarm categories for the generated alarm (replaces alarmCategories when set)
    - `rootCauseAnalysisScript` string — Name of the library script used for root cause analysis
    - `actions` object[] — Server actions executed when the rule matches
      - `id` integer — Server action ID
      - `timerDelay` string — Delay before executing the action (seconds; supports macro expansion). Empty for immediate execution.
      - `timerKey` string — Timer key (supports macro expansion); used together with timerCancellations
      - `blockingTimerKey` string — Action is suppressed while a timer with this key is active
      - `snoozeTime` string — Minimum interval between repeated executions (seconds; supports macro expansion)
      - `active` boolean — Whether the action is enabled
    - `timerCancellations` string[] — Timer keys to cancel when the rule matches
    - `actionScript` string — NXSL action script executed when the rule matches
    - `pstorageSetActions` object — Persistent storage entries to set (key/value pairs; values support macro expansion)
    - `pstorageDeleteActions` string[] — Persistent storage keys to delete
    - `customAttributeSetActions` object — Custom attributes to set on the source object (key/value pairs; values support macro expansion)
    - `customAttributeDeleteActions` string[] — Custom attribute names to delete from the source object
    - `downtimeTag` string — Downtime tag used when starting or ending maintenance downtime
    - `incidentDelay` integer — Delay in seconds before an incident is created (0 = immediate)
    - `incidentTitle` string — Incident title template (empty = use alarm message)
    - `incidentDescription` string — Incident description template
    - `incidentAIAnalysisDepth` integer — Depth of AI incident analysis (0=quick, 1=standard, 2=thorough)
    - `incidentAIPrompt` string — Custom AI analysis instructions for the incident
    - `aiAgentInstructions` string — Instructions for the AI agent when generating an alarm comment
    - `comments` string — Rule description

## Response `200`

Chain rules updated successfully

- EventProcessingPolicyUpdateResult — Result of a successful chain rules update
  - `chainId` integer — ID of the updated chain (0 = main chain)
  - `version` integer — New chain version
  - `ruleCount` integer — Number of rules now in the chain
  - `warnings` string — Human-readable text describing any issues encountered while applying the rules (e.g. references to objects or chains that no longer exist). Present only if there were warnings.

## Other responses

- `400` — Chain ID is not a number or rule data is invalid
- `401` — Unauthorized
- `403` — User cannot edit this chain (global EPP right, or edit right from the chain access list, required; the main chain requires the global right), or a rule calls a chain the user cannot read
- `404` — Chain not found
- `409` — Version conflict - the chain was modified by another client
- `500` — Database failure

## Changes

- **2026-09-08** `4fd66f32833f` — 1 info
  - endpoint added
- **2026-09-08** `c2492179ed18` — 1 breaking
  - api path removed without deprecation
- **2026-09-07** `3aeada4e28f8` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/netxms/apis/netxms-api/changes/v1/event-processing-policy/chains/:chain-id/rules/put.md)

---

[API](https://skmtc.dev/netxms/apis/netxms-api.md) · [All operations](https://skmtc.dev/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc.dev/netxms/apis/netxms-api/revisions/db519d190a4c?raw)