---
title: "create rule"
method: POST
path: "/rules"
tags: ["rule"]
---

# create rule

`POST /rules`

## Query parameters

- `run-tests-first` boolean — set this field to false to exclude running tests prior to saving
- `run-tests-only` boolean — set this field to true if you want to run tests without saving

## Request body

- RuleAPIModifyRule
  - `body` string, required — The python body of the rule
  - `createAlert` boolean — Determines whether the rule should create alerts when it triggers
  - `dedupPeriodMinutes` integer — The amount of time in minutes for grouping alerts
  - `description` string — The description of the rule
  - `displayName` string — The display name of the rule
  - `enabled` boolean — Determines whether or not the rule is active
  - `id` string, required — The id of the rule
  - `inlineFilters` string — The filter for the rule represented in YAML
  - `logTypes` string[] — log types
  - `managed` boolean — Determines if the rule is managed by panther
  - `outputIDs` string[] — Destination IDs that override default alert routing based on severity
  - `reference` string — A URL or note for additional reference material
  - `reports` object — reports
  - `runbook` string — How to handle the generated alert
  - `severity` 'INFO' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required
  - `summaryAttributes` string[] — A list of fields in the event to create top 5 summaries for
  - `tags` string[] — The tags for the rule
  - `tests` RuleAPIUnitTest[] — Unit tests for the Rule. Best practice is to include a positive and negative case
    - `expectedResult` boolean, required — The expected result
    - `log` unknown
    - `mocks` RuleAPIUnitTestMock[] — mocks
    - `name` string, required — name
    - `resource` string — A test event object that your detection will receive as input, JSON-encoded. Prefer `log`.
  - `threshold` integer — the number of events that must match before an alert is triggered

## Response `200`

OK response.

- RuleAPIRule
  - `body` string — The python body of the rule
  - `createAlert` boolean — Determines whether the rule should create alerts when it triggers
  - `createdAt` string
  - `createdBy` object — The actor who created the rule
    - `id` 'user' | 'api-token' | 'system'
    - `type` string
  - `createdByExternal` string — The text of the user-provided CreatedBy field when uploaded via CI/CD
  - `dedupPeriodMinutes` integer — The amount of time in minutes for grouping alerts
  - `description` string — The description of the rule
  - `displayName` string — The display name of the rule
  - `enabled` boolean — Determines whether or not the rule is active
  - `id` string — The id of the rule
  - `inlineFilters` string — The filter for the rule represented in YAML
  - `lastModified` string
  - `logTypes` string[] — log types
  - `managed` boolean — Determines if the rule is managed by panther
  - `outputIDs` string[] — Destination IDs that override default alert routing based on severity
  - `reference` string — A URL or note for additional reference material
  - `reports` object — reports
  - `runbook` string — How to handle the generated alert
  - `severity` 'INFO' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL'
  - `summaryAttributes` string[] — A list of fields in the event to create top 5 summaries for
  - `tags` string[] — The tags for the rule
  - `tests` RuleAPIUnitTest[] — Unit tests for the Rule. Best practice is to include a positive and negative case
    - `expectedResult` boolean, required — The expected result
    - `log` unknown
    - `mocks` RuleAPIUnitTestMock[] — mocks
    - `name` string, required — name
    - `resource` string — A test event object that your detection will receive as input, JSON-encoded. Prefer `log`.
  - `threshold` integer — the number of events that must match before an alert is triggered

## Other responses

- `204` — No Content response.
- `400` — bad_request: Bad Request response.
- `409` — exists: Conflict response.

---

[API](https://skmtc.dev/panther/apis/panther-rest-api.md) · [All operations](https://skmtc.dev/panther/apis/panther-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/panther/panther-rest-api/revisions/eb177cb9d6a1/schema)