---
title: "Create YARA rule"
method: POST
path: "/yara"
---

# Create YARA rule

`POST /yara`

## Request

- Base URL: `https://sandbox.recordedfuture.com/api/v0`
- URL: `https://sandbox.recordedfuture.com/api/v0/yara`
- Auth: API key in header `Authorization`

Add a custom YARA rule compiled and validated server-side for automatic matching in future analyses.

## Request body

- object
  - `name` string, required: Rule filename (e.g., my_rule.yar)
  - `rule` string, required: YARA rule content

## Response `200`

Rule created successfully.

- object: Empty response confirming rule creation.

## Other responses

- `400`: Compilation error or duplicate name.

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-sandbox-api-secopsti.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-sandbox-api-secopsti/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-sandbox-api-secopsti/revisions/39ea918b1dca?raw)