---
title: "List"
method: POST
path: "/v1/rules/list"
tags: ["Fraud"]
---

# List

`POST /v1/rules/list`

## Request

- Base URL: `https://telemetry.stytch.com`
- URL: `https://telemetry.stytch.com/v1/rules/list`
- Auth: HTTP basic

Get all rules that have been set for your project.

## Request body

- ApiFraudV1FraudRulesListRequest: Request type
  - `cursor` string: The `cursor` field allows you to paginate through your results. Each result array is limited to 100 results. If your query returns more than 100 results, you will need to paginate the responses using the `cursor`. If you receive a response that includes a non-null `next_cursor`, repeat the request with the `next_cursor` value set to the `cursor` field to retrieve the next page of results. Continue to make requests until the `next_cursor` in the response is null.
  - `limit` integer: The number of results to return per page. The default limit is 10. A maximum of 100 results can be returned by a single get request. If the total size of your result set is greater than one page size, you must paginate the response. See the `cursor` field.

## Response `200`

Successful response

- ApiFraudV1FraudRulesListResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `next_cursor` string, required: The `next_cursor` string is returned when your result contains more than one page of results. This value is passed into your next request in the `cursor` field.
  - `rules` ApiFraudV1Rule[], required: A list of rules for the project
    - `rule_type` 'VISITOR_ID' | 'BROWSER_ID' | 'VISITOR_FINGERPRINT' | 'BROWSER_FINGERPRINT' | 'HARDWARE_FINGERPRINT' | 'NETWORK_FINGERPRINT' | 'CIDR_BLOCK' | 'ASN' | 'COUNTRY_CODE', required
    - `action` 'ALLOW' | 'CHALLENGE' | 'BLOCK' | 'NONE', required
    - `created_at` string, required: The time when the rule was created. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
    - `visitor_id` string: The visitor ID that a rule was set for.
    - `browser_id` string: The browser ID that a rule was set for.
    - `visitor_fingerprint` string: The visitor fingerprint that a rule was set for.
    - `browser_fingerprint` string: The browser fingerprint that a rule was set for.
    - `hardware_fingerprint` string: The hardware fingerprint that a rule was set for.
    - `network_fingerprint` string: The network fingerprint that a rule was set for.
    - `cidr_block` string: The CIDR block that a rule was set for. If an end user's IP address is within this CIDR block, this rule will be applied.
    - `country_code` string: The country code that a rule was set for.
    - `asn` string: The ASN that a rule was set for.
    - `description` string: A description for the rule.
    - `expires_at` string: The timestamp when the rule expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
    - `last_updated_at` string: The time when the rule was last updated. Will be null if the rule has never been updated. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2025-10-23** `4a2e3c0c0c05`: 1 breaking, 1 warning, 4 info
  - removed the required property `verdict_reason_actions` from the response with the `200` status
  - removed the request property `overrides_only`
  - added the new optional request property `cursor`
  - added the new optional request property `limit`
  - …2 more
- **2025-09-17** `8270cf3a3d4c`: 3 info
  - added the media type `application/json` for the response with the status `401`
  - added the media type `application/json` for the response with the status `500`
  - added the non-success response with the status `429`
- **2025-09-17** `864b9f438ac0`: 2 breaking
  - the `overrides_only` request property type changed from `string` to `boolean`
  - the `status_code` response's property type changed from `string` to `integer`, and format from no format to `int32` for status `200`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/rules/list/post.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)