Create a rule in your organization.
One endpoint handles all supported rule_type values; the shape of content
must match the type (see request examples in this operation).
rule_type | content format | Notes |
|---|---|---|
atomic_sql | sql_query, optional entities, level | Per-event predicate. |
scheduled_sql | query, schedule, entities, optional throttle | Org predicate optional; named form. |
signal_combination | query, schedule, description | Internal portal org only. |
Org scoping is applied per tenant at execution, so a query does not need its own
organization_id predicate. If you want one, use the named form —
organization_id = %(organization_id)s or nebulock_organization_id = %(organization_id)s
— which the engine resolves at render time. The positional form (organization_id = ?) is
rejected on save: ClickHouse has no positional binding, so it cannot be parsed. Existing
rules that still use it are only warned about.
Organization ID: Omit organization_id to create under your session organization.
If provided, it must match your session — cross-tenant creates are rejected.
Global rules are created by signing in as NEBULOCK_INTERNAL_PORTAL_ORG_ID;
the legacy "*" marker is not accepted.
Status: New rules must be inactive (the default) — active and experimental
are rejected on create. A rule goes live only after a retro run proves it executes:
create it, run POST /rules/{rule_id}/runs, then PATCH /rules/{rule_id}/set-status.
Validation failures return 400 with error.message = "Rule validation failed",
the reasons in error.validation_errors and error.field_validations, and
error.debug holding the diagnostics behind them (engine payload, the SQL that was
checked, a ClickHouse backtrace). Fix against the first; quote the second to us.
error.message_markdown is the same error list rendered as markdown bullets, for
showing the failure without building the list yourself.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||