---
title: "Get event processing policy"
method: GET
path: "/v1/event-processing-policy"
tags: ["Event Processing Policy"]
---

# Get event processing policy

`GET /v1/event-processing-policy`

Retrieve the complete event processing policy as an ordered list of rules. The returned
`version` value should be sent back unchanged in a subsequent update request to detect
concurrent modifications (optimistic concurrency control).

## Response `200`

Event processing policy retrieved successfully

- EventProcessingPolicy — Event processing policy - an ordered list of rules plus a version for optimistic concurrency control
  - `version` integer — Policy version, incremented on every change. Send this value back when updating the policy to detect concurrent modifications.
  - `ruleCount` integer — Number of rules in the policy
  - `rules` EventProcessingPolicyRule[] — Rules in evaluation order
    - `guid` string, uuid — Rule GUID. A new random GUID is generated on input if omitted.
    - `ruleNumber` integer — 1-based position of the rule in the policy (output only; ignored on input - array order is authoritative)
    - `flags` integer — Rule flags bitmask: 0x000001 stop processing, 0x000002 negated source match, 0x000004 negated event match, 0x000008 generate alarm, 0x000010 disabled, 0x000020 terminate alarms by regular expression, 0x000100..0x001000 match severity (info/warning/minor/major/critical), 0x002000 create helpdesk ticket, 0x004000 accept correlated events, 0x008000 negated time frame match, 0x010000 start downtime, 0x020000 end downtime, 0x040000 request AI comment, 0x080000 create incident, 0x100000 AI analyze incident, 0x200000 AI auto-assign incident
    - `sources` integer[] — Source object IDs the rule matches (empty = match any source)
    - `sourceExclusions` integer[] — Source object IDs explicitly excluded from matching
    - `events` integer[] — Event codes the rule matches (empty = match any event)
    - `timeFrames` object[] — Time frames during which the rule is active (empty = always active)
      - `time` integer — Time-of-day filter bitmask
      - `date` integer — Date filter bitmask (day of month / month / day of week)
    - `filterScript` string — NXSL filter script source; rule matches only if the script returns true
    - `alarmSeverity` integer — Severity of the generated alarm: 0=Normal, 1=Warning, 2=Minor, 3=Major, 4=Critical, 5=same as event, 6=terminate alarms, 7=resolve alarms
    - `alarmKey` string — Alarm key template (supports macro expansion)
    - `alarmMessage` string — Alarm message template (supports macro expansion)
    - `alarmImpact` string — Alarm impact description template
    - `alarmTimeout` integer — Alarm timeout in seconds (0 = no timeout)
    - `alarmTimeoutEvent` integer — Event code generated when the alarm times out
    - `alarmCategories` integer[] — Alarm category IDs assigned to the generated alarm
    - `rootCauseAnalysisScript` string — Name of the library script used for root cause analysis
    - `actions` object[] — Server actions executed when the rule matches
      - `id` integer — Server action ID
      - `timerDelay` string — Delay before executing the action (seconds; supports macro expansion). Empty for immediate execution.
      - `timerKey` string — Timer key (supports macro expansion); used together with timerCancellations
      - `blockingTimerKey` string — Action is suppressed while a timer with this key is active
      - `snoozeTime` string — Minimum interval between repeated executions (seconds; supports macro expansion)
      - `active` boolean — Whether the action is enabled
    - `timerCancellations` string[] — Timer keys to cancel when the rule matches
    - `actionScript` string — NXSL action script executed when the rule matches
    - `pstorageSetActions` object — Persistent storage entries to set (key/value pairs; values support macro expansion)
    - `pstorageDeleteActions` string[] — Persistent storage keys to delete
    - `customAttributeSetActions` object — Custom attributes to set on the source object (key/value pairs; values support macro expansion)
    - `customAttributeDeleteActions` string[] — Custom attribute names to delete from the source object
    - `downtimeTag` string — Downtime tag used when starting or ending maintenance downtime
    - `incidentDelay` integer — Delay in seconds before an incident is created (0 = immediate)
    - `incidentTitle` string — Incident title template (empty = use alarm message)
    - `incidentDescription` string — Incident description template
    - `incidentAIAnalysisDepth` integer — Depth of AI incident analysis (0=quick, 1=standard, 2=thorough)
    - `incidentAIPrompt` string — Custom AI analysis instructions for the incident
    - `aiAgentInstructions` string — Instructions for the AI agent when generating an alarm comment
    - `comments` string — Rule description

## Other responses

- `401` — Unauthorized
- `403` — User does not have EPP access right

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/versions/14d93e5115dd/schema)