API Reference
  1. Rules API
  2. public

List Rules Public Api

get
https://api.nebulock.io/public/v1/rules

List rules for the authenticated organization.

Results are always scoped to nebulock_session.organization_id. There is no
organization_id query parameter — tenant sessions see only their rules;
internal-portal sessions see only portal-owned global rules. Scheduler fan-out
that merges portal globals with tenant rules uses GET /v1/rules/internal/query.

query_for_latest_trigger=true adds meta.latest_trigger — the same payload
POST /rules/most-recent-trigger returns, covering every rule on this page in one
lookup. It fails open: returning your rules matters more than returning this, so if
the engine is unavailable the rules still come back and meta.latest_trigger reports
the failure itself (empty data, null meta, reason in meta.latest_trigger.error).

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Query Params
1 to 1000

Maximum number of rules to return

Number of rules to skip

Field to order by (updated_at, created_at, title, severity, status, rule_type, version)

Order direction (asc/desc)

Rule version filter (latest, all, or specific version number)

RuleType | array | null

Rule type filter (single value or repeated query parameter)

string | array | null

Filter by rule ID (single or list of IDs)

Filter by title (partial match, case-insensitive)

Filter by description (partial match, case-insensitive)

Filter by rule content (partial match, case-insensitive)

0 to 100

Filter by severity (0-100)

enum

Filter by status

Rule status. See signal-api's RULE_LIFECYCLE.md for the transition diagram.

array | null

Filter by tags (rules must contain all specified tags)

array | null

Filter by detection categories (rules must contain all specified values)

array | null

Filter by data sources (rules must contain all specified values)

Keyword search across title, description, content, and tags (partial, case-insensitive)

Filter by user ID that created the rule

Filter by last updated user ID

Filter rules created after this datetime

Filter rules created before this datetime

Filter rules updated after this datetime

Filter rules updated before this datetime

boolean
Defaults to false

Include the last retrohunt run summary for each rule

boolean
Defaults to false

Look up when each returned rule last produced a signal and report it under meta.latest_trigger. Uses the default 14-day window; call POST /rules/most-recent-trigger directly for a longer one.

boolean
Defaults to false

Populate RulePublic.execution_sql with render-ready SQL. Escaped for the engine's query % params render, so consume it verbatim. Null for rule types with no SQL and for rules whose stored content failed validation.

Headers
string
required

Your API Key ID

string

Your API Key Secret

Responses

Updated 28 days ago

Did this page help you?
Language
Credentials
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated 28 days ago

Did this page help you?