BatchUpdateRules

curl --request PUT \
  --url https://api.siftstack.com/api/v1/rules:batchUpdate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "rules": [
    {
      "name": "<string>",
      "description": "<string>",
      "conditions": [
        {
          "expression": {},
          "actions": [
            {
              "actionType": "ACTION_KIND_UNSPECIFIED",
              "configuration": {},
              "ruleActionId": "<string>"
            }
          ],
          "ruleConditionId": "<string>"
        }
      ],
      "metadata": [
        {
          "key": {
            "name": "<string>",
            "type": "METADATA_KEY_TYPE_UNSPECIFIED",
            "archivedDate": "2023-11-07T05:31:56Z",
            "isArchived": true
          },
          "stringValue": "<string>",
          "numberValue": 123,
          "booleanValue": true,
          "archivedDate": "2023-11-07T05:31:56Z",
          "isArchived": true
        }
      ],
      "ruleId": "<string>",
      "assetId": "<string>",
      "isEnabled": true,
      "organizationId": "<string>",
      "versionNotes": "<string>",
      "clientKey": "<string>",
      "assetConfiguration": {
        "assetIds": [
          "<string>"
        ],
        "tagIds": [
          "<string>"
        ]
      },
      "isExternal": true,
      "isArchived": true,
      "isLiveEvaluationEnabled": true
    }
  ],
  "validateOnly": true,
  "overrideExpressionValidation": true
}
'

import requests

url = "https://api.siftstack.com/api/v1/rules:batchUpdate"

payload = {
    "rules": [
        {
            "name": "<string>",
            "description": "<string>",
            "conditions": [
                {
                    "expression": {},
                    "actions": [
                        {
                            "actionType": "ACTION_KIND_UNSPECIFIED",
                            "configuration": {},
                            "ruleActionId": "<string>"
                        }
                    ],
                    "ruleConditionId": "<string>"
                }
            ],
            "metadata": [
                {
                    "key": {
                        "name": "<string>",
                        "type": "METADATA_KEY_TYPE_UNSPECIFIED",
                        "archivedDate": "2023-11-07T05:31:56Z",
                        "isArchived": True
                    },
                    "stringValue": "<string>",
                    "numberValue": 123,
                    "booleanValue": True,
                    "archivedDate": "2023-11-07T05:31:56Z",
                    "isArchived": True
                }
            ],
            "ruleId": "<string>",
            "assetId": "<string>",
            "isEnabled": True,
            "organizationId": "<string>",
            "versionNotes": "<string>",
            "clientKey": "<string>",
            "assetConfiguration": {
                "assetIds": ["<string>"],
                "tagIds": ["<string>"]
            },
            "isExternal": True,
            "isArchived": True,
            "isLiveEvaluationEnabled": True
        }
    ],
    "validateOnly": True,
    "overrideExpressionValidation": True
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.siftstack.com/api/v1/rules:batchUpdate"

	payload := strings.NewReader("{\n  \"rules\": [\n    {\n      \"name\": \"<string>\",\n      \"description\": \"<string>\",\n      \"conditions\": [\n        {\n          \"expression\": {},\n          \"actions\": [\n            {\n              \"actionType\": \"ACTION_KIND_UNSPECIFIED\",\n              \"configuration\": {},\n              \"ruleActionId\": \"<string>\"\n            }\n          ],\n          \"ruleConditionId\": \"<string>\"\n        }\n      ],\n      \"metadata\": [\n        {\n          \"key\": {\n            \"name\": \"<string>\",\n            \"type\": \"METADATA_KEY_TYPE_UNSPECIFIED\",\n            \"archivedDate\": \"2023-11-07T05:31:56Z\",\n            \"isArchived\": true\n          },\n          \"stringValue\": \"<string>\",\n          \"numberValue\": 123,\n          \"booleanValue\": true,\n          \"archivedDate\": \"2023-11-07T05:31:56Z\",\n          \"isArchived\": true\n        }\n      ],\n      \"ruleId\": \"<string>\",\n      \"assetId\": \"<string>\",\n      \"isEnabled\": true,\n      \"organizationId\": \"<string>\",\n      \"versionNotes\": \"<string>\",\n      \"clientKey\": \"<string>\",\n      \"assetConfiguration\": {\n        \"assetIds\": [\n          \"<string>\"\n        ],\n        \"tagIds\": [\n          \"<string>\"\n        ]\n      },\n      \"isExternal\": true,\n      \"isArchived\": true,\n      \"isLiveEvaluationEnabled\": true\n    }\n  ],\n  \"validateOnly\": true,\n  \"overrideExpressionValidation\": true\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "success": true,
  "rulesCreatedCount": 123,
  "rulesUpdatedCount": 123,
  "validateOnly": true,
  "validationResults": [
    {
      "assetExpressionValidationResults": [
        {
          "assetId": "<string>",
          "assetName": "<string>",
          "assetTagId": "<string>",
          "error": "<string>"
        }
      ],
      "ruleId": "<string>",
      "clientKey": "<string>",
      "error": "<string>",
      "ruleName": "<string>"
    }
  ],
  "createdRuleIdentifiers": [
    {
      "ruleId": "<string>",
      "name": "<string>",
      "clientKey": "<string>"
    }
  ]
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

PUT

api

rules:batchUpdate

BatchUpdateRules

curl --request PUT \
  --url https://api.siftstack.com/api/v1/rules:batchUpdate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "rules": [
    {
      "name": "<string>",
      "description": "<string>",
      "conditions": [
        {
          "expression": {},
          "actions": [
            {
              "actionType": "ACTION_KIND_UNSPECIFIED",
              "configuration": {},
              "ruleActionId": "<string>"
            }
          ],
          "ruleConditionId": "<string>"
        }
      ],
      "metadata": [
        {
          "key": {
            "name": "<string>",
            "type": "METADATA_KEY_TYPE_UNSPECIFIED",
            "archivedDate": "2023-11-07T05:31:56Z",
            "isArchived": true
          },
          "stringValue": "<string>",
          "numberValue": 123,
          "booleanValue": true,
          "archivedDate": "2023-11-07T05:31:56Z",
          "isArchived": true
        }
      ],
      "ruleId": "<string>",
      "assetId": "<string>",
      "isEnabled": true,
      "organizationId": "<string>",
      "versionNotes": "<string>",
      "clientKey": "<string>",
      "assetConfiguration": {
        "assetIds": [
          "<string>"
        ],
        "tagIds": [
          "<string>"
        ]
      },
      "isExternal": true,
      "isArchived": true,
      "isLiveEvaluationEnabled": true
    }
  ],
  "validateOnly": true,
  "overrideExpressionValidation": true
}
'

import requests

url = "https://api.siftstack.com/api/v1/rules:batchUpdate"

payload = {
    "rules": [
        {
            "name": "<string>",
            "description": "<string>",
            "conditions": [
                {
                    "expression": {},
                    "actions": [
                        {
                            "actionType": "ACTION_KIND_UNSPECIFIED",
                            "configuration": {},
                            "ruleActionId": "<string>"
                        }
                    ],
                    "ruleConditionId": "<string>"
                }
            ],
            "metadata": [
                {
                    "key": {
                        "name": "<string>",
                        "type": "METADATA_KEY_TYPE_UNSPECIFIED",
                        "archivedDate": "2023-11-07T05:31:56Z",
                        "isArchived": True
                    },
                    "stringValue": "<string>",
                    "numberValue": 123,
                    "booleanValue": True,
                    "archivedDate": "2023-11-07T05:31:56Z",
                    "isArchived": True
                }
            ],
            "ruleId": "<string>",
            "assetId": "<string>",
            "isEnabled": True,
            "organizationId": "<string>",
            "versionNotes": "<string>",
            "clientKey": "<string>",
            "assetConfiguration": {
                "assetIds": ["<string>"],
                "tagIds": ["<string>"]
            },
            "isExternal": True,
            "isArchived": True,
            "isLiveEvaluationEnabled": True
        }
    ],
    "validateOnly": True,
    "overrideExpressionValidation": True
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.siftstack.com/api/v1/rules:batchUpdate"

	payload := strings.NewReader("{\n  \"rules\": [\n    {\n      \"name\": \"<string>\",\n      \"description\": \"<string>\",\n      \"conditions\": [\n        {\n          \"expression\": {},\n          \"actions\": [\n            {\n              \"actionType\": \"ACTION_KIND_UNSPECIFIED\",\n              \"configuration\": {},\n              \"ruleActionId\": \"<string>\"\n            }\n          ],\n          \"ruleConditionId\": \"<string>\"\n        }\n      ],\n      \"metadata\": [\n        {\n          \"key\": {\n            \"name\": \"<string>\",\n            \"type\": \"METADATA_KEY_TYPE_UNSPECIFIED\",\n            \"archivedDate\": \"2023-11-07T05:31:56Z\",\n            \"isArchived\": true\n          },\n          \"stringValue\": \"<string>\",\n          \"numberValue\": 123,\n          \"booleanValue\": true,\n          \"archivedDate\": \"2023-11-07T05:31:56Z\",\n          \"isArchived\": true\n        }\n      ],\n      \"ruleId\": \"<string>\",\n      \"assetId\": \"<string>\",\n      \"isEnabled\": true,\n      \"organizationId\": \"<string>\",\n      \"versionNotes\": \"<string>\",\n      \"clientKey\": \"<string>\",\n      \"assetConfiguration\": {\n        \"assetIds\": [\n          \"<string>\"\n        ],\n        \"tagIds\": [\n          \"<string>\"\n        ]\n      },\n      \"isExternal\": true,\n      \"isArchived\": true,\n      \"isLiveEvaluationEnabled\": true\n    }\n  ],\n  \"validateOnly\": true,\n  \"overrideExpressionValidation\": true\n}")

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "success": true,
  "rulesCreatedCount": 123,
  "rulesUpdatedCount": 123,
  "validateOnly": true,
  "validationResults": [
    {
      "assetExpressionValidationResults": [
        {
          "assetId": "<string>",
          "assetName": "<string>",
          "assetTagId": "<string>",
          "error": "<string>"
        }
      ],
      "ruleId": "<string>",
      "clientKey": "<string>",
      "error": "<string>",
      "ruleName": "<string>"
    }
  ],
  "createdRuleIdentifiers": [
    {
      "ruleId": "<string>",
      "name": "<string>",
      "clientKey": "<string>"
    }
  ]
}

{
  "code": 123,
  "message": "<string>",
  "details": [
    {
      "@type": "<string>"
    }
  ]
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

rules

rules are limited 1000 rules at a time · object[]

required

Show child attributes

validateOnly

boolean

If validate_only is true, the request will only validate the request and not save the rules.

overrideExpressionValidation

boolean

Discouraged escape hatch for saving rules whose expression cannot be fully validated server-side. When true:

Per-asset expression validation errors (e.g. channel not present on the in-scope asset) are returned in validation_results for visibility but do not block the save.
If the rule's UDF/calculated-channel inlining cannot resolve types (typically because the referenced channels haven't been ingested yet, or there are too many distinct identifiers for the type-inference budget) the rule is still persisted, but its is_live_evaluation_enabled is forced to false. Live alerts will skip it; report generation and on-demand EvaluateRules calls still work because they re-resolve types at run time. To bring such a rule back online, fix the underlying problem (ingest the channels, simplify the expression, etc.) and reissue an update with is_live_evaluation_enabled = true.

Marked deprecated = true because new integrations should validate input before submitting; existing SDK call sites that rely on this flag continue to work.

Response

A successful response.

success

boolean

required

True if no rule has an error, or override_expression_validation is true. False if any rule has an error and that override is unset. When false and validate_only is false.

rulesCreatedCount

integer<int32>

required

Number of request rules classified as creates (no matching rule_id or existing client_key). Includes rules that failed validation. If validate_only is true, nothing is written unless override_expression_validation is true.

rulesUpdatedCount

integer<int32>

required

Number of request rules classified as updates (matched by rule_id or an existing client_key). Includes rules that failed validation. If validate_only is true, nothing is written unless override_expression_validation is true.

validateOnly

boolean

required

True if the request only validated the rules and did not save them.

validationResults

object[]

required

Rules that have at least one error (rules with multiple failing assets will appear multiple times). Passing rules are omitted, so this list is often shorter than rules. Match a result with rule_id, client_key, or rule_name; do not zip by index. A rule with several failing assets can appear more than once. Rule-level errors with no per-asset expression error do not appear.

Show child attributes

createdRuleIdentifiers

object[]

required

Identifiers for rules this request created. Empty when validate_only is true or success is false.

Show child attributes

Authenticate

Clients

Review

Export

Attachments

Reference

BatchUpdateRules

Authorizations

Body

Response