---
title: "Replace event processing policy"
method: PUT
path: "/v1/event-processing-policy"
tags: ["Event Processing Policy"]
---

# Replace event processing policy

`PUT /v1/event-processing-policy`

Replace the entire event processing policy with the supplied ordered list of rules.
If `version` is present in the request body it must match the current policy version,
otherwise the request is rejected with status 409 and the body contains the current
`currentVersion`. If `version` is omitted the policy is replaced unconditionally.

Each rule may be supplied either in the form produced by this API (object IDs and event
codes as plain integers) or as a configuration export record (object/event references as
objects carrying name and GUID); the latter form is resolved on import and any references
that cannot be resolved are dropped, with details returned in the optional `warnings` field.

## Request body

- EventProcessingPolicyUpdateRequest — Request body for replacing the entire event processing policy
  - `version` integer — Expected current policy version. If present, the update is applied only if it matches the server-side version, otherwise the request is rejected with status 409. If omitted, the policy is replaced unconditionally.
  - `rules` EventProcessingPolicyRule[], required — New rule list in evaluation order (the existing policy is fully replaced)
    - `guid` string, uuid — Rule GUID. A new random GUID is generated on input if omitted.
    - `ruleNumber` integer — 1-based position of the rule in the policy (output only; ignored on input - array order is authoritative)
    - `flags` integer — Rule flags bitmask: 0x000001 stop processing, 0x000002 negated source match, 0x000004 negated event match, 0x000008 generate alarm, 0x000010 disabled, 0x000020 terminate alarms by regular expression, 0x000100..0x001000 match severity (info/warning/minor/major/critical), 0x002000 create helpdesk ticket, 0x004000 accept correlated events, 0x008000 negated time frame match, 0x010000 start downtime, 0x020000 end downtime, 0x040000 request AI comment, 0x080000 create incident, 0x100000 AI analyze incident, 0x200000 AI auto-assign incident
    - `sources` integer[] — Source object IDs the rule matches (empty = match any source)
    - `sourceExclusions` integer[] — Source object IDs explicitly excluded from matching
    - `events` integer[] — Event codes the rule matches (empty = match any event)
    - `timeFrames` object[] — Time frames during which the rule is active (empty = always active)
      - `time` integer — Time-of-day filter bitmask
      - `date` integer — Date filter bitmask (day of month / month / day of week)
    - `filterScript` string — NXSL filter script source; rule matches only if the script returns true
    - `alarmSeverity` integer — Severity of the generated alarm: 0=Normal, 1=Warning, 2=Minor, 3=Major, 4=Critical, 5=same as event, 6=terminate alarms, 7=resolve alarms
    - `alarmKey` string — Alarm key template (supports macro expansion)
    - `alarmMessage` string — Alarm message template (supports macro expansion)
    - `alarmImpact` string — Alarm impact description template
    - `alarmTimeout` integer — Alarm timeout in seconds (0 = no timeout)
    - `alarmTimeoutEvent` integer — Event code generated when the alarm times out
    - `alarmCategories` integer[] — Alarm category IDs assigned to the generated alarm
    - `rootCauseAnalysisScript` string — Name of the library script used for root cause analysis
    - `actions` object[] — Server actions executed when the rule matches
      - `id` integer — Server action ID
      - `timerDelay` string — Delay before executing the action (seconds; supports macro expansion). Empty for immediate execution.
      - `timerKey` string — Timer key (supports macro expansion); used together with timerCancellations
      - `blockingTimerKey` string — Action is suppressed while a timer with this key is active
      - `snoozeTime` string — Minimum interval between repeated executions (seconds; supports macro expansion)
      - `active` boolean — Whether the action is enabled
    - `timerCancellations` string[] — Timer keys to cancel when the rule matches
    - `actionScript` string — NXSL action script executed when the rule matches
    - `pstorageSetActions` object — Persistent storage entries to set (key/value pairs; values support macro expansion)
    - `pstorageDeleteActions` string[] — Persistent storage keys to delete
    - `customAttributeSetActions` object — Custom attributes to set on the source object (key/value pairs; values support macro expansion)
    - `customAttributeDeleteActions` string[] — Custom attribute names to delete from the source object
    - `downtimeTag` string — Downtime tag used when starting or ending maintenance downtime
    - `incidentDelay` integer — Delay in seconds before an incident is created (0 = immediate)
    - `incidentTitle` string — Incident title template (empty = use alarm message)
    - `incidentDescription` string — Incident description template
    - `incidentAIAnalysisDepth` integer — Depth of AI incident analysis (0=quick, 1=standard, 2=thorough)
    - `incidentAIPrompt` string — Custom AI analysis instructions for the incident
    - `aiAgentInstructions` string — Instructions for the AI agent when generating an alarm comment
    - `comments` string — Rule description

## Response `200`

Event processing policy updated successfully

- EventProcessingPolicyUpdateResult — Result of a successful event processing policy update
  - `version` integer — New policy version
  - `ruleCount` integer — Number of rules now in the policy
  - `warnings` string — Human-readable text describing any issues encountered while applying the rules (e.g. references to objects that no longer exist). Present only if there were warnings.

## Other responses

- `400` — Invalid event processing policy data
- `401` — Unauthorized
- `403` — User does not have EPP access right
- `409` — Version conflict - the policy was modified by another client
- `500` — Database failure

---

[API](https://skmtc.net/netxms/apis/netxms-api.md) · [All operations](https://skmtc.net/netxms/apis/netxms-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netxms/netxms-api/versions/14d93e5115dd/schema)