AlertsUpdate a rule

Update a rule

Change any field. Only the fields sent change. A rule that lost its last channel was disabled. Enabling it again needs channel_ids in the same request (400 invalid_rule otherwise).

curl -X PATCH "https://mythic-analytics.gulp.workers.dev/client/v1/alerts/rules/123e4567-e89b-12d3-a456-426614174000" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{
  "enabled": false
}'
{
  "success": true,
  "data": {
    "name": "John Doe",
    "sources": [
      "contracts"
    ],
    "location_ids": [
      "example_string"
    ],
    "min_severity": "info",
    "channel_ids": [
      "123e4567-e89b-12d3-a456-426614174000"
    ],
    "notify_on_resolve": true,
    "enabled": true,
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "created_at": "2024-12-25T10:00:00Z",
    "updated_at": "2024-12-25T10:00:00Z"
  }
}
PATCH
/client/v1/alerts/rules/{id}
PATCH
Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token
Bearer Tokenstring
Required

Agency key (ak_) only; a location secret key (sk_) gets 403 agency_required. Agency-wide scoped keys (mcp_) are accepted and need alerts:read or alerts:write. Keys are server-side credentials; this surface serves no CORS headers.

Agency key (ak_) only; a location secret key (sk_) gets 403 agency_required. Agency-wide scoped keys (mcp_) are accepted and need alerts:read or alerts:write. Keys are server-side credentials; this surface serves no CORS headers.
Content-Typestring
Required

The media type of the request body

Options: application/json
namestring
Max length: 120
sourcesarray

Empty or omitted = every source.

location_idsarray

Client ids. Empty or omitted = every client, including ones added later. Agency-level alerts (quota) only match rules that cover every client.

min_severitystring

The default, info, receives every alert. drift and 80% quota raise only info.

Options: info, warning, critical
channel_idsarray

Required on create, at least one. Channels must belong to the agency.

Request Preview
Response

Response will appear here after sending the request

Authentication

header
Authorizationstring
Required

Bearer token. Agency key (ak_) only; a location secret key (sk_) gets 403 agency_required. Agency-wide scoped keys (mcp_) are accepted and need alerts:read or alerts:write. Keys are server-side credentials; this surface serves no CORS headers.

Path Parameters

Body

application/json
sourcesarray

Empty or omitted = every source.

location_idsarray

Client ids. Empty or omitted = every client, including ones added later. Agency-level alerts (quota) only match rules that cover every client.

min_severitystring

The default, info, receives every alert. drift and 80% quota raise only info.

Allowed values:infowarningcritical
channel_idsarray

Required on create, at least one. Channels must belong to the agency.

Responses

successboolean
datastring