--- title: "Get Rule Exception" method: POST path: "/detection-rule-exception/{id}/get-item" tags: ["Rule Exception"] --- # Get Rule Exception `POST /detection-rule-exception/{id}/get-item` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/detection-rule-exception/{id}/get-item` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to retrieve a single Rule Exception by ID ## Path parameters - `id` string, uuid, required ## Request body - object - `select` DetectionRuleExceptionSelectSchema: Select schema for DetectionRuleException. Set fields to true to include them in the response. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `detectionRuleId` boolean - `kind` boolean - `entityType` boolean - `fieldName` boolean - `value` boolean - `startsAt` boolean - `endsAt` boolean - `reason` boolean - `expiresAt` boolean - `createdByUserId` boolean - `deletedByUserId` boolean ## Response `200` Successful response - object - `data` DetectionRuleException - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `version` number: Object version - `projectId` string, uuid, required: ID of the project this exception belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `detectionRuleId` string, uuid, required: ID of the detection rule that skips what this names. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `kind` 'Entity' | 'Value' | 'Time Window', required: What the rule skips: Entity (a user, host or IP address), Value (one event field's value) or Time Window (every event between two times). Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `entityType` 'User' | 'Host' | 'IP Address' | 'Domain' | 'URL' | 'File Hash' | 'Process' | 'Data Store' | 'Other': For an Entity: User, Host or IP Address. The rule skips every event that names it, as who acted, as who was acted on, or among its observables. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `fieldName` string: For a Value: the event field to match, named as in a Sigma rule - principalUser, processName, an attribute key such as http.user_agent. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `value` string: For an Entity or a Value: what the rule skips, matched whatever the case. * stands for any run of characters (svc-* skips every service account), and an IP address may be a range such as 10.20.0.0/16. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `startsAt` object: For a Time Window: the first moment the rule skips. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `endsAt` object: For a Time Window: when the rule sees events again. A window is at most 30 days. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `reason` string, required: Why it is safe for the rule to skip this, for whoever reads the list later. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `expiresAt` object: For an Entity or a Value: when the rule sees it again. Empty: until someone deletes the exception. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `createdByUserId` string, uuid: ID of the person who added the exception. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the person who removed the exception. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)