Update an alert rule
Changes a rule's name, cooldown, settings, channels, or enabled state. Sending channelIds replaces the whole set. The event type cannot be changed; create another rule instead.
Requires the manager role on the website and the alerting plan feature.
AuthorizationBearer <JWT>An OpenID Connect access token from signing in to CentralCSP, acting as the signed-in user.
workspaceId*stringThe workspace's id.
websiteId*stringThe website's id.
ruleId*stringThe alert rule's id.
application/json- body
name?stringNew display name.
1 <= length <= 255cooldownSeconds?|How long to collect findings before sending, in seconds, up to 24 hours. Everything found in that time arrives as one notification. Defaults to 900.
0 <= value <= 86400config?|Replace the rule's settings, or send null to go back to the defaults. Per-rule settings, shaped by the event type: spike thresholds for a *:spike rule, a minimum severity for sbom:new-cve, the watched statuses for sbom:version-status. Rejected on any other type.
channelIds?array<string>Ids of the channels to notify, all from this website. An empty list notifies nobody.
items <= 20enabled?booleanTurn the rule on or off.
What a website notifies about.
application/json- response
id*stringThe rule's id.
workspaceId*stringThe workspace's id.
websiteId*stringThe website's id.
name*stringDisplay name.
eventType*AlertEventTypeWhat to notify about.
csp-violation:new-type: a new CSP directive and blocked origin pair appears in the reports.csp-hash:new-script-origin: a script loads from a new origin.network-error:new-failing-origin: a new origin starts failing network requests.coop:new-violation,coep:new-violation: a new COOP or COEP violation type appears.permissions-policy:new-violation: a new Permissions Policy violation appears.deprecation:new-api: a deprecated API is reported for the first time.intervention:new-type: a browser intervention is reported for the first time.connection-allowlist:new-blocked-origin: a new blocked connection origin appears.compliance:new-script: a script never seen before runs on a payment page and no reviewer or inventory rule has justified it yet.compliance:script-changed: a payment-page script serves different content and no reviewer or inventory rule has justified the new content yet.csp-violation:spike,integrity-violation:spike,network-error:spike,crash:spike: an hour's report count reaches at least 50 and 3 times the hourly average of the previous 24 hours. Both thresholds are adjustable withconfig.sbom:new-cve: a technology on the website gains a known vulnerability at or above the rule's minimum severity.sbom:version-status: a technology is detected with, or moves to, one of the rule'sstatuses.sbom:new-technology: the website starts loading a technology, or a version of one, it did not load before.
"csp-violation:new-type""csp-violation:spike""csp-hash:new-script-origin""integrity-violation:spike""compliance:new-script""compliance:script-changed""network-error:new-failing-origin""network-error:spike""crash:spike""coop:new-violation""coep:new-violation""permissions-policy:new-violation""deprecation:new-api""intervention:new-type""connection-allowlist:new-blocked-origin""sbom:new-cve""sbom:version-status""sbom:new-technology"cooldownSeconds*|How long findings are collected before a notification is sent, in seconds.
config*|Per-rule settings, shaped by the event type: spike thresholds for a *:spike rule, a minimum severity for sbom:new-cve, the watched statuses for sbom:version-status. null when the rule uses the defaults or its type has no settings.
enabled*booleanA disabled rule sends nothing.
channelIds*array<string>Ids of the channels this rule notifies.
createdAt*stringWhen the rule was created.
date-timeupdatedAt*stringWhen the rule was last changed.
date-timecurl -X PATCH 'https://api.centralcsp.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/websites/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/alerts/rules/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90' \ -H 'Content-Type: application/json' \ -d '{}'{ "id": "string", "workspaceId": "string", "websiteId": "string", "name": "New third-party script", "eventType": "csp-violation:new-type", "cooldownSeconds": 0, "config": { "multiplier": 3, "floor": 50, "minSeverity": "medium", "statuses": [ "deprecated" ] }, "enabled": true, "channelIds": [ "string" ], "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z"}