List Rules Public Api

List rules for the authenticated organization.

Results are always scoped to nebulock_session.organization_id. There is no
organization_id query parameter — tenant sessions see only their rules;
internal-portal sessions see only portal-owned global rules. Scheduler fan-out
that merges portal globals with tenant rules uses GET /v1/rules/internal/query.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Query Params
1 to 1000

Maximum number of rules to return

Number of rules to skip

Field to order by (updated_at, created_at, title, severity, status, rule_type, version)

Order direction (asc/desc)

Rule version filter (latest, all, or specific version number)

RuleType | array | null

Rule type filter (single value or repeated query parameter)

string | array | null

Filter by rule ID (single or list of IDs)

Filter by title (partial match, case-insensitive)

Filter by description (partial match, case-insensitive)

Filter by rule content (partial match, case-insensitive)

0 to 100

Filter by severity (0-100)

enum

Filter by status


Rule status. See RULE_LIFECYCLE.md for state transition diagram.

array | null

Filter by tags (rules must contain all specified tags)

array | null

Filter by detection categories (rules must contain all specified values)

array | null

Filter by data sources (rules must contain all specified values)

Keyword search across title, description, content, and tags (partial, case-insensitive)

Filter by user ID that created the rule

Filter by last updated user ID

Filter rules created after this datetime

Filter rules created before this datetime

Filter rules updated after this datetime

Filter rules updated before this datetime

boolean
Defaults to false

Include the last retrohunt run summary for each rule

Headers
string
required

Your API Key ID

string

Your API Key Secret

Responses

Language
Credentials
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json