Create an alert rule
Starts notifying on an event type through the channels you list, which must belong to this website. A new rule only notifies about events that happen after it is created. Counts against the plan's rule limit.
Requires the manager role on the website and the alerting plan feature.
AuthorizationBearer <JWT>An OpenID Connect access token from signing in to CentralCSP, acting as the signed-in user.
workspaceId*stringThe workspace's id.
websiteId*stringThe website's id.
application/json- body
name*stringDisplay name for the rule.
1 <= length <= 255eventType*AlertEventTypeWhat to notify about.
csp-violation:new-type: a new CSP directive and blocked origin pair appears in the reports.csp-hash:new-script-origin: a script loads from a new origin.network-error:new-failing-origin: a new origin starts failing network requests.coop:new-violation,coep:new-violation: a new COOP or COEP violation type appears.permissions-policy:new-violation: a new Permissions Policy violation appears.deprecation:new-api: a deprecated API is reported for the first time.intervention:new-type: a browser intervention is reported for the first time.connection-allowlist:new-blocked-origin: a new blocked connection origin appears.compliance:new-script: a script never seen before runs on a payment page and no reviewer or inventory rule has justified it yet.compliance:script-changed: a payment-page script serves different content and no reviewer or inventory rule has justified the new content yet.csp-violation:spike,integrity-violation:spike,network-error:spike,crash:spike: an hour's report count reaches at least 50 and 3 times the hourly average of the previous 24 hours. Both thresholds are adjustable withconfig.sbom:new-cve: a technology on the website gains a known vulnerability at or above the rule's minimum severity.sbom:version-status: a technology is detected with, or moves to, one of the rule'sstatuses.sbom:new-technology: the website starts loading a technology, or a version of one, it did not load before.
"csp-violation:new-type""csp-violation:spike""csp-hash:new-script-origin""integrity-violation:spike""compliance:new-script""compliance:script-changed""network-error:new-failing-origin""network-error:spike""crash:spike""coop:new-violation""coep:new-violation""permissions-policy:new-violation""deprecation:new-api""intervention:new-type""connection-allowlist:new-blocked-origin""sbom:new-cve""sbom:version-status""sbom:new-technology"cooldownSeconds?|How long to collect findings before sending, in seconds, up to 24 hours. Everything found in that time arrives as one notification. Defaults to 900.
0 <= value <= 86400config?Per-rule settings, shaped by the event type: spike thresholds for a *:spike rule, a minimum severity for sbom:new-cve, the watched statuses for sbom:version-status. Rejected on any other type.
channelIds*array<string>Ids of the channels to notify, all from this website. An empty list notifies nobody.
items <= 20enabled?booleanDefaults to true.
What a website notifies about.
application/json- response
id*stringThe rule's id.
workspaceId*stringThe workspace's id.
websiteId*stringThe website's id.
name*stringDisplay name.
eventType*AlertEventTypeWhat to notify about.
csp-violation:new-type: a new CSP directive and blocked origin pair appears in the reports.csp-hash:new-script-origin: a script loads from a new origin.network-error:new-failing-origin: a new origin starts failing network requests.coop:new-violation,coep:new-violation: a new COOP or COEP violation type appears.permissions-policy:new-violation: a new Permissions Policy violation appears.deprecation:new-api: a deprecated API is reported for the first time.intervention:new-type: a browser intervention is reported for the first time.connection-allowlist:new-blocked-origin: a new blocked connection origin appears.compliance:new-script: a script never seen before runs on a payment page and no reviewer or inventory rule has justified it yet.compliance:script-changed: a payment-page script serves different content and no reviewer or inventory rule has justified the new content yet.csp-violation:spike,integrity-violation:spike,network-error:spike,crash:spike: an hour's report count reaches at least 50 and 3 times the hourly average of the previous 24 hours. Both thresholds are adjustable withconfig.sbom:new-cve: a technology on the website gains a known vulnerability at or above the rule's minimum severity.sbom:version-status: a technology is detected with, or moves to, one of the rule'sstatuses.sbom:new-technology: the website starts loading a technology, or a version of one, it did not load before.
"csp-violation:new-type""csp-violation:spike""csp-hash:new-script-origin""integrity-violation:spike""compliance:new-script""compliance:script-changed""network-error:new-failing-origin""network-error:spike""crash:spike""coop:new-violation""coep:new-violation""permissions-policy:new-violation""deprecation:new-api""intervention:new-type""connection-allowlist:new-blocked-origin""sbom:new-cve""sbom:version-status""sbom:new-technology"cooldownSeconds*|How long findings are collected before a notification is sent, in seconds.
config*|Per-rule settings, shaped by the event type: spike thresholds for a *:spike rule, a minimum severity for sbom:new-cve, the watched statuses for sbom:version-status. null when the rule uses the defaults or its type has no settings.
enabled*booleanA disabled rule sends nothing.
channelIds*array<string>Ids of the channels this rule notifies.
createdAt*stringWhen the rule was created.
date-timeupdatedAt*stringWhen the rule was last changed.
date-timecurl -X POST 'https://api.centralcsp.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/websites/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/alerts/rules' \ -H 'Content-Type: application/json' \ -d '{ "name": "New third-party script", "eventType": "csp-violation:new-type", "channelIds": [ "string" ]}'{ "id": "string", "workspaceId": "string", "websiteId": "string", "name": "New third-party script", "eventType": "csp-violation:new-type", "cooldownSeconds": 0, "config": { "multiplier": 3, "floor": 50, "minSeverity": "medium", "statuses": [ "deprecated" ] }, "enabled": true, "channelIds": [ "string" ], "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z"}