API Reference

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Detectors

List all detectors

GET/api/detectors

Create a new detector

POST/api/detectors

Delete a detector and its rules

DELETE/api/detectors/{detectorId}

Evaluate rules against an event

POST/api/detectors/{detectorId}/evaluate

ModelsExpand Collapse

DetectorListResponse object { errors, messages, result, success }

errors: array of object { code, message }

code: number

minimum1000

message: string

messages: array of object { code, message }

code: number

minimum1000

message: string

result: array of object { id, name }

id: string

name: string

success: boolean

DetectorCreateResponse object { errors, messages, result, success }

errors: array of object { code, message }

code: number

minimum1000

message: string

messages: array of object { code, message }

code: number

minimum1000

message: string

result: object { id }

id: string

success: boolean

DetectorDeleteResponse object { errors, messages, result, success }

errors: array of object { code, message }

code: number

minimum1000

message: string

messages: array of object { code, message }

code: number

minimum1000

message: string

result: object { id }

id: string

success: boolean

DetectorEvaluateResponse object { errors, messages, result, success }

errors: array of object { code, message }

code: number

minimum1000

message: string

messages: array of object { code, message }

code: number

minimum1000

message: string

result: object { actions }

actions: array of unknown

success: boolean

DetectorsRules

List rules for a detector

GET/api/detectors/{detectorId}/rules

Create a new rule

POST/api/detectors/{detectorId}/rules

Update a rule

PATCH/api/detectors/{detectorId}/rules/{id}

Delete a rule

DELETE/api/detectors/{detectorId}/rules/{id}

ModelsExpand Collapse

AllCondition object { all }

all: array of Condition

AnyCondition object { any }

any: array of Condition

Condition = LeafCondition { leaf } or RefCondition { ref } or InRelationCondition { in_relation } or 10 more

One of the following:

LeafCondition object { leaf }

leaf: object { fact, op, value }

fact: string

op: "eq" or "neq" or "in" or 4 more

One of the following:

"eq"

"neq"

"in"

"nin"

"contains"

"matches"

"between"

value: string or number or boolean or 2 more

One of the following:

string

number

boolean

array of string

array of number

RefCondition object { ref }

ref: object { fact, op, reference }

fact: string

op: "eq" or "neq" or "in" or "nin"

One of the following:

"eq"

"neq"

"in"

"nin"

reference: string

InRelationCondition object { in_relation }

in_relation: object { args, relation }

args: array of unknown

relation: string

AllCondition object { all }

all: array of Condition

AnyCondition object { any }

any: array of Condition

NotCondition object { not }

not: Condition

OnceCondition object { once }

once: Condition

HistoricallyCondition object { historically }

historically: Condition

SinceCondition object { since }

since: object { left, right }

left: Condition

right: Condition

OnceWithinCondition object { once_within }

once_within: object { inner, window_secs }

inner: Condition

window_secs: number

HistoricallyForCondition object { historically_for }

historically_for: object { inner, window_secs, boundary }

inner: Condition

window_secs: number

boundary: optional "weak" or "strong"

One of the following:

"weak"

"strong"

SinceWithinCondition object { since_within }

since_within: object { left, right, window_secs }

left: Condition

right: Condition

window_secs: number

KeyedCondition object { keyed }

keyed: object { inner, key }

inner: Condition

key: string

HistoricallyCondition object { historically }

historically: Condition

HistoricallyForCondition object { historically_for }

historically_for: object { inner, window_secs, boundary }

inner: Condition

window_secs: number

boundary: optional "weak" or "strong"

One of the following:

"weak"

"strong"

InRelationCondition object { in_relation }

in_relation: object { args, relation }

args: array of unknown

relation: string

KeyedCondition object { keyed }

keyed: object { inner, key }

inner: Condition

key: string

LeafCondition object { leaf }

leaf: object { fact, op, value }

fact: string

op: "eq" or "neq" or "in" or 4 more

One of the following:

"eq"

"neq"

"in"

"nin"

"contains"

"matches"

"between"

value: string or number or boolean or 2 more

One of the following:

string

number

boolean

array of string

array of number

NotCondition object { not }

not: Condition

OnceCondition object { once }

once: Condition

OnceWithinCondition object { once_within }

once_within: object { inner, window_secs }

inner: Condition

window_secs: number

RefCondition object { ref }

ref: object { fact, op, reference }

fact: string

op: "eq" or "neq" or "in" or "nin"

One of the following:

"eq"

"neq"

"in"

"nin"

reference: string

SinceCondition object { since }

since: object { left, right }

left: Condition

right: Condition

SinceWithinCondition object { since_within }

since_within: object { left, right, window_secs }

left: Condition

right: Condition

window_secs: number

RuleListResponse object { errors, messages, result, success }

errors: array of object { code, message }

code: number

minimum1000

message: string

messages: array of object { code, message }

code: number

minimum1000

message: string

result: object { rules }

rules: array of object { id, condition, detectorId, 4 more }

id: string

condition: Condition

One of the following:

LeafCondition object { leaf }

leaf: object { fact, op, value }

fact: string

op: "eq" or "neq" or "in" or 4 more

One of the following:

"eq"

"neq"

"in"

"nin"

"contains"

"matches"

"between"

value: string or number or boolean or 2 more

One of the following:

string

number

boolean

array of string

array of number

RefCondition object { ref }

ref: object { fact, op, reference }

fact: string

op: "eq" or "neq" or "in" or "nin"

One of the following:

"eq"

"neq"

"in"

"nin"

reference: string

InRelationCondition object { in_relation }

in_relation: object { args, relation }

args: array of unknown

relation: string

AllCondition object { all }

all: array of Condition

AnyCondition object { any }

any: array of Condition

NotCondition object { not }

not: Condition

OnceCondition object { once }

once: Condition

HistoricallyCondition object { historically }

historically: Condition

SinceCondition object { since }

since: object { left, right }

left: Condition

right: Condition

OnceWithinCondition object { once_within }

once_within: object { inner, window_secs }

inner: Condition

window_secs: number

HistoricallyForCondition object { historically_for }

historically_for: object { inner, window_secs, boundary }

inner: Condition

window_secs: number

boundary: optional "weak" or "strong"

One of the following:

"weak"

"strong"

SinceWithinCondition object { since_within }

since_within: object { left, right, window_secs }

left: Condition

right: Condition

window_secs: number

KeyedCondition object { keyed }

keyed: object { inner, key }

inner: Condition

key: string

detectorId: string

enabled: boolean

name: string

notify: boolean

priority: number

success: boolean

RuleCreateResponse object { errors, messages, result, success }

errors: array of object { code, message }

code: number

minimum1000

message: string

messages: array of object { code, message }

code: number

minimum1000

message: string

result: object { id }

id: string

success: boolean

RuleUpdateResponse object { errors, messages, result, success }

errors: array of object { code, message }

code: number

minimum1000

message: string

messages: array of object { code, message }

code: number

minimum1000

message: string

result: object { id, condition, detectorId, 4 more }

id: string

condition: Condition

One of the following:

LeafCondition object { leaf }

leaf: object { fact, op, value }

fact: string

op: "eq" or "neq" or "in" or 4 more

One of the following:

"eq"

"neq"

"in"

"nin"

"contains"

"matches"

"between"

value: string or number or boolean or 2 more

One of the following:

string

number

boolean

array of string

array of number

RefCondition object { ref }

ref: object { fact, op, reference }

fact: string

op: "eq" or "neq" or "in" or "nin"

One of the following:

"eq"

"neq"

"in"

"nin"

reference: string

InRelationCondition object { in_relation }

in_relation: object { args, relation }

args: array of unknown

relation: string

AllCondition object { all }

all: array of Condition

AnyCondition object { any }

any: array of Condition

NotCondition object { not }

not: Condition

OnceCondition object { once }

once: Condition

HistoricallyCondition object { historically }

historically: Condition

SinceCondition object { since }

since: object { left, right }

left: Condition

right: Condition

OnceWithinCondition object { once_within }

once_within: object { inner, window_secs }

inner: Condition

window_secs: number

HistoricallyForCondition object { historically_for }

historically_for: object { inner, window_secs, boundary }

inner: Condition

window_secs: number

boundary: optional "weak" or "strong"

One of the following:

"weak"

"strong"

SinceWithinCondition object { since_within }

since_within: object { left, right, window_secs }

left: Condition

right: Condition

window_secs: number

KeyedCondition object { keyed }

keyed: object { inner, key }

inner: Condition

key: string

detectorId: string

enabled: boolean

name: string

notify: boolean

priority: number

success: boolean

RuleDeleteResponse object { errors, messages, result, success }

errors: array of object { code, message }

code: number

minimum1000

message: string

messages: array of object { code, message }

code: number

minimum1000

message: string

result: object { id }

id: string

success: boolean