---
title: "Create a mute rule"
method: POST
path: "/api/v2/security/findings/automation/mute_rules"
tags: ["Security Monitoring"]
---

# Create a mute rule

`POST /api/v2/security/findings/automation/mute_rules`

Create a new mute rule for the current organization.

## Request body

- MuteRuleCreateRequest — The body of a mute rule create request.
  - `data` MuteRuleDataCreate, required — The data object for a mute rule create or update request.
    - `attributes` MuteRuleAttributesCreate, required — Attributes for creating or updating a mute rule.
      - `action` MuteRuleAction, required — The action to take when the mute rule matches a finding.
        - `expire_at` integer — The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire.
        - `reason` 'duplicate' | 'false_positive' | 'no_fix' | 'other' | 'pending_fix' | 'risk_accepted', required — The reason for muting a security finding.
        - `reason_description` string — An optional description providing more context for the mute reason.
      - `enabled` boolean — Whether the mute rule is enabled.
      - `name` string, required — The name of the mute rule.
      - `rule` AutomationRuleScope, required — Defines the scope of findings to which the automation rule applies.
        - `finding_types` SecurityFindingType[], required — The list of security finding types that the automation rule applies to.
        - `query` string — A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/).
    - `type` 'mute_rules', required — The JSON:API type for mute rules.

## Response `201`

Successfully created the mute rule

- MuteRuleResponse — A single mute rule response.
  - `data` MuteRuleDataResponse, required — The data object for a mute rule returned by the API.
    - `attributes` MuteRuleAttributesResponse, required — Attributes of a mute rule returned by the API.
      - `action` MuteRuleAction, required — The action to take when the mute rule matches a finding.
        - `expire_at` integer — The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire.
        - `reason` 'duplicate' | 'false_positive' | 'no_fix' | 'other' | 'pending_fix' | 'risk_accepted', required — The reason for muting a security finding.
        - `reason_description` string — An optional description providing more context for the mute reason.
      - `created_at` integer, required — The Unix timestamp in milliseconds when the rule was created.
      - `created_by` AutomationRuleCreatedBy, required — The user or Datadog system who created the rule.
        - `id` string, required — The actor's identifier (a user UUID or a system identifier).
        - `name` string, required — The name of the actor.
        - `type` 'user' | 'system', required — Whether the actor is a user or the Datadog system.
      - `enabled` boolean, required — Whether the mute rule is enabled.
      - `modified_at` integer, required — The Unix timestamp in milliseconds when the rule was last modified.
      - `modified_by` AutomationRuleModifiedBy, required — The user or Datadog system who last modified the rule.
        - `id` string, required — The actor's identifier (a user UUID or a system identifier).
        - `name` string, required — The name of the actor.
        - `type` 'user' | 'system', required — Whether the actor is a user or the Datadog system.
      - `name` string, required — The name of the mute rule.
      - `rule` AutomationRuleScope, required — Defines the scope of findings to which the automation rule applies.
        - `finding_types` SecurityFindingType[], required — The list of security finding types that the automation rule applies to.
        - `query` string — A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/).
    - `id` string, uuid, required — The ID of the mute rule.
    - `type` 'mute_rules', required — The JSON:API type for mute rules.

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `422` — Unprocessable Entity
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)