Create an alert rule
Starts notifying on an event type through the channels you list, which must belong to this website. Detection runs about once a minute and only looks forward, so a new rule never replays history. Counts against the plan's rule limit.
Requires the manager role on the website and the alerting plan feature.
An OpenID Connect access token issued by Keycloak, acting as the signed-in user.
In: header
Path Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Display name for the rule.
1 <= length <= 255What to notify about. new-* types fire the first time something appears in a website's reports: a CSP directive and blocked origin pair, a script origin, a failing network origin, a COOP or COEP violation type, a Permissions Policy violation, a deprecated API, a browser intervention, or a blocked connection origin. compliance:unjustified-script fires when a payment-page script needs review. *:spike types fire when an hour's report volume reaches at least 50 reports and three times the trailing 24-hour average, both adjustable per rule with config. sbom:new-cve fires when a technology on the website gains a known vulnerability at or above the rule's minimum severity; sbom:version-status fires when a technology is detected as, or becomes, outdated or deprecated, per the rule's statuses.
Value in
- "csp-violation:new-type"
- "csp-violation:spike"
- "csp-hash:new-script-origin"
- "integrity-violation:spike"
- "compliance:unjustified-script"
- "network-error:new-failing-origin"
- "network-error:spike"
- "crash:spike"
- "coop:new-violation"
- "coep:new-violation"
- "permissions-policy:new-violation"
- "deprecation:new-api"
- "intervention:new-type"
- "connection-allowlist:new-blocked-origin"
- "sbom:new-cve"
- "sbom:version-status"
How long to collect findings before sending, up to 24 hours. Everything found in that time arrives as one notification. Defaults to 900 seconds.
0 <= value <= 86400Per-rule settings, shaped by the event type: spike thresholds for a *:spike rule, a minimum severity for sbom:new-cve, the watched statuses for sbom:version-status. Rejected on any other type.
Channels to notify. They must belong to this website. An empty list means the rule detects but notifies nobody.
items <= 20Defaults to true.
Response Body
application/json
curl -X POST "https://example.com/v1/workspaces/string/websites/string/alerts/rules" \ -H "Content-Type: application/json" \ -d '{ "name": "New third-party script", "eventType": "csp-violation:new-type", "channelIds": [ "string" ] }'{ "id": "string", "workspaceId": "string", "websiteId": "string", "name": "New third-party script", "eventType": "csp-violation:new-type", "cooldownSeconds": 0, "config": { "multiplier": 3, "floor": 50, "minSeverity": "medium", "statuses": [ "deprecated" ] }, "enabled": true, "channelIds": [ "string" ], "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z"}