Create Rule
POST/api/v1/rules
Create a new hunt rule via RuleCreationService.
The service sanitizes the SQL, applies CEL->SQL transpilation, validates column references, and optionally estimates query cost. A rule whose SQL the hunt runner could not compile is refused with 422. The cost preview counts only the orgs the hunts running the rule read, cut to the orgs its author may read.
A production+team write is routed to a review branch instead of the branch the
runner git-syncs, and the X-DFE-Review-Required header says so.
Request
Responses
- 201
- 401
- 403
- 422
- default
Successful Response
No valid session: the credentials are missing, invalid or expired, or the account behind them is disabled or blocked
Refused: the session lacks the action this route checks, or its account must replace an issued password first. A SCIM route answers a refused action in the RFC 7644 error envelope
Refused, nothing written. The body failed validation (code validation_error). Or the hunt runner could not compile the rule -- its SQL does not parse as one SELECT, names no <db>.<table> source, names a source that is not a table name (letters, digits, '_' and '-'), has no WHERE to detect with, or calls a function that reads outside the row (url, s3, a dictionary) or sends it to another service (the ai* functions), or carries a CEL filter that does not transpile (code invalid_sql, the errors in sql_errors). Or the rule matches every event in its source (code rule_matches_everything, the source and detection WHERE in context).
Problem details (RFC 9457)