---
title: "Update Scanning Rule"
method: PATCH
path: "/api/v2/sensitive-data-scanner/config/rules/{rule_id}"
tags: ["Sensitive Data Scanner"]
---

# Update Scanning Rule

`PATCH /api/v2/sensitive-data-scanner/config/rules/{rule_id}`

Update a scanning rule.
The request body MUST NOT include a standard_pattern relationship, as that relationship
is non-editable. Trying to edit the regex attribute of a rule with a standard_pattern
relationship will also result in an error.

## Path parameters

- `rule_id` string, required

## Request body

- SensitiveDataScannerRuleUpdateRequest — Update rule request.
  - `data` SensitiveDataScannerRuleUpdate, required — Data related to the update of a rule.
    - `attributes` SensitiveDataScannerRuleAttributes — Attributes of the Sensitive Data Scanner rule.
      - `description` string — Description of the rule.
      - `excluded_namespaces` string[] — Attributes excluded from the scan. If namespaces is provided, it has to be a sub-path of the namespaces array.
      - `included_keyword_configuration` SensitiveDataScannerIncludedKeywordConfiguration — Object defining a set of keywords and a number of characters that help reduce noise. You can provide a list of keywords you would like to check within a defined proximity of the matching pattern. If any of the keywords are found within the proximity check, the match is kept. If none are found, the match is discarded.
        - `character_count` integer, required — The number of characters behind a match detected by Sensitive Data Scanner to look for the keywords defined. `character_count` should be greater than the maximum length of a keyword defined for a rule.
        - `keywords` string[], required — Keyword list that will be checked during scanning in order to validate a match. The number of keywords in the list must be less than or equal to 30.
        - `use_recommended_keywords` boolean — Should the rule use the underlying standard pattern keyword configuration. If set to `true`, the rule must be tied to a standard pattern. If set to `false`, the specified keywords and `character_count` are applied.
      - `is_enabled` boolean — Whether or not the rule is enabled.
      - `name` string — Name of the rule.
      - `namespaces` string[] — Attributes included in the scan. If namespaces is empty or missing, all attributes except excluded_namespaces are scanned. If both are missing the whole event is scanned.
      - `pattern` string — Not included if there is a relationship to a standard pattern.
      - `priority` integer — Integer from 1 (high) to 5 (low) indicating rule issue severity.
      - `suppressions` SensitiveDataScannerSuppressions — Object describing the suppressions for a rule. There are three types of suppressions, `starts_with`, `ends_with`, and `exact_match`. Suppressed matches are not obfuscated, counted in metrics, or displayed in the Findings page.
        - `ends_with` string[] — List of strings to use for suppression of matches ending with these strings.
        - `exact_match` string[] — List of strings to use for suppression of matches exactly matching these strings.
        - `starts_with` string[] — List of strings to use for suppression of matches starting with these strings.
      - `tags` string[] — List of tags.
      - `text_replacement` SensitiveDataScannerTextReplacement — Object describing how the scanned event will be replaced.
        - `number_of_chars` integer — Required if type == 'partial_replacement_from_beginning' or 'partial_replacement_from_end'. It must be > 0.
        - `replacement_string` string — Required if type == 'replacement_string'.
        - `should_save_match` boolean — Only valid when type == `replacement_string`. When enabled, matches can be unmasked in logs by users with ‘Data Scanner Unmask’ permission. As a security best practice, avoid masking for highly-sensitive, long-lived data.
        - `type` 'none' | 'hash' | 'replacement_string' | 'partial_replacement_from_beginning' | 'partial_replacement_from_end' — Type of the replacement text. None means no replacement. hash means the data will be stubbed. replacement_string means that one can chose a text to replace the data. partial_replacement_from_beginning allows a user to partially replace the data from the beginning, and partial_replacement_from_end on the other hand, allows to replace data from the end.
    - `id` string — ID of the rule.
    - `relationships` SensitiveDataScannerRuleRelationships — Relationships of a scanning rule.
      - `group` SensitiveDataScannerGroupData — A scanning group data.
        - `data` SensitiveDataScannerGroup — A scanning group.
          - `id` string — ID of the group.
          - `type` 'sensitive_data_scanner_group' — Sensitive Data Scanner group type.
      - `standard_pattern` SensitiveDataScannerStandardPatternData — A standard pattern.
        - `data` SensitiveDataScannerStandardPattern — Data containing the standard pattern id.
          - `id` string — ID of the standard pattern.
          - `type` 'sensitive_data_scanner_standard_pattern' — Sensitive Data Scanner standard pattern type.
    - `type` 'sensitive_data_scanner_rule' — Sensitive Data Scanner rule type.
  - `meta` SensitiveDataScannerMetaVersionOnly, required — Meta payload containing information about the API.
    - `version` integer — Version of the API (optional).

## Response `200`

OK

- SensitiveDataScannerRuleUpdateResponse — Update rule response.
  - `meta` SensitiveDataScannerMetaVersionOnly — Meta payload containing information about the API.
    - `version` integer — Version of the API (optional).

## Other responses

- `400` — Bad Request
- `403` — Authentication Error
- `404` — Not Found
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)