---
title: "Import detection rules"
method: POST
path: "/api/detection_engine/rules/_import"
tags: ["Security Detections API"]
---

# Import detection rules

`POST /api/detection_engine/rules/_import`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/_import</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Import detection rules from an `.ndjson` file, including actions and exception lists. The request must include:
- The `Content-Type: multipart/form-data` HTTP header.
- A link to the `.ndjson` file containing the rules.
> warn
> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.
> info
> To import rules with actions, you need at least Read privileges for the Action and Connectors feature. To overwrite or add new connectors, you need All privileges for the Actions and Connectors feature. To import rules without actions, you don’t need Actions and Connectors privileges. Refer to [Enable and access detections](https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-privileges) for more information.

> info
> Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.

> You can use Kibana’s [Saved Objects](https://www.elastic.co/docs/explore-analyze/find-and-organize/saved-objects) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](../operation/operation-post-saved-objects-export) and [import](../operation/operation-post-saved-objects-import) any necessary connectors before importing detection rules.

> Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.

## Query parameters

- `overwrite` boolean
- `overwrite_exceptions` boolean
- `overwrite_action_connectors` boolean
- `as_new_list` boolean

## Response `200`

Indicates a successful call.

- object
  - `action_connectors_errors` SecurityDetectionsAPIErrorSchema[], required
    - `error` object, required
      - `message` string, required
      - `status_code` integer, required
    - `id` string
    - `item_id` string
    - `list_id` string
    - `rule_id` string — A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s.
  - `action_connectors_success` boolean, required
  - `action_connectors_success_count` integer, required
  - `action_connectors_warnings` SecurityDetectionsAPIWarningSchema[], required
    - `actionPath` string, required
    - `buttonLabel` string
    - `message` string, required
    - `type` string, required
  - `errors` SecurityDetectionsAPIErrorSchema[], required
    - `error` object, required
      - `message` string, required
      - `status_code` integer, required
    - `id` string
    - `item_id` string
    - `list_id` string
    - `rule_id` string — A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s.
  - `exceptions_errors` SecurityDetectionsAPIErrorSchema[], required
    - `error` object, required
      - `message` string, required
      - `status_code` integer, required
    - `id` string
    - `item_id` string
    - `list_id` string
    - `rule_id` string — A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s.
  - `exceptions_success` boolean, required
  - `exceptions_success_count` integer, required
  - `rules_count` integer, required
  - `success` boolean, required
  - `success_count` integer, required

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)