--- title: "Update an Event Rule" method: PUT path: "/rulesets/{id}/rules/{rule_id}" tags: ["Rulesets"] --- # Update an Event Rule `PUT /rulesets/{id}/rules/{rule_id}` Update an Event Rule. Note that the endpoint supports partial updates, so any number of the writable fields can be provided. > ### End-of-life > Rulesets and Event Rules will end-of-life soon. We highly recommend that you [migrate to Event Orchestration](https://support.pagerduty.com/docs/migrate-to-event-orchestration) as soon as possible so you can take advantage of the new functionality, such as improved UI, rule creation, APIs and Terraform support, advanced conditions, and rule nesting. Rulesets allow you to route events to an endpoint and create collections of Event Rules, which define sets of actions to take based on event content. For more information see the [API Concepts Document](../../api-reference/a47605517c19a-api-concepts#rulesets) Note: Create and Update on rules will accept 'description' or 'summary' interchangeably as an extraction action target. Get and List on rules will always return 'summary' as the target. If you are expecting 'description' please change your automation code to expect 'summary' instead. Scoped OAuth requires: `event_rules.write` ## Path parameters - `id` string, required - `rule_id` string, required ## Headers - `Accept` string, required - `Content-Type` 'application/json', required ## Request body - object - `rule` EventRule - `id` string — ID of the Event Rule. - `self` string, url — the API show URL at which the object is accessible. - `disabled` boolean — Indicates whether the Event Rule is disabled and would therefore not be evaluated. - `conditions` object — Conditions evaluated to check if an event matches this Event Rule. Is always empty for the catch_all rule, though. - `operator` 'and' | 'or', required — Operator to combine sub-conditions. - `subconditions` object[], required — Array of sub-conditions. - `operator` 'exists' | 'nexists' | 'equals' | 'nequals' | 'contains' | 'ncontains' | 'matches' | 'nmatches', required — The type of operator to apply. - `parameters` object, required - `path` string, required — Path to a field in an event, in dot-notation. For Event Rules on a serivce, this will have to be a PD-CEF field. - `value` string, required — Value to apply to the operator. - `options` object — Options to configure the operator. - `time_frame` object — Time-based conditions for limiting when the rule is active. - `active_between` object — A fixed window of time during which the rule is active. - `start_time` integer, required — The start time in milliseconds. - `end_time` integer, required — End time in milliseconds. - `scheduled_weekly` object — A reccuring window of time based on the day of the week, during which the rule is active. - `start_time` integer, required — The amount of milliseconds into the day at which the window starts. - `duration` integer, required — The duration of the window in milliseconds. - `timezone` string, required — The timezone. - `weekdays` integer[], required — An array of day values. Ex [1, 3, 5] is Monday, Wednesday, Friday. - `variables` object[] — [Early Access] Populate variables from event payloads and use those variables in other event actions. - `type` 'regex', required — The type of operation to populate the variable. - `name` string, required — The name of the variable. - `parameters` object, required — The parameters for performing the operation to populate the - `value` string, required — The value for the operation. For example, an RE2 regular expression for regex-type variables. - `path` string, required — Path to a field in an event, in dot-notation. For Event Rules on a Service, this will have to be a PD-CEF field. - `position` integer — Position/index of the Event Rule in the Ruleset. Starting from position 0 (the first rule), rules are evaluated one-by-one until a matching rule is found. - `catch_all` boolean — Indicates whether the Event Rule is the last Event Rule of the Ruleset that serves as a catch-all. It has limited functionality compared to other rules and always matches. - `actions` object — When an event matches this Event Rule, the actions that will be taken to change the resulting Alert and Incident. - `annotate` object, nullable — Set a note on the resulting incident. - `value` string, required — The content of the note. - `event_action` object, nullable — Set whether the resulting alert status is trigger or resolve. - `value` 'trigger' | 'resolve', required - `extractions` union[] — Dynamically extract values to set and modify new and existing PD-CEF fields. - union - object - `target` string, required — The PD-CEF field that will be set with the value from the regex. - `source` string, required — The path to the event field where the regex will be applied to extract a value. - `regex` string, required — A RE2 regular expression. If it contains one or more capture groups, their values will be extracted and appended together. If it contains no capture groups, the whole match is used. - object - `target` string, required — The PD-CEF field that will be set with the value from the regex. - `template` string, required — A value that will be used to populate the target PD-CEF field. You can include variables extracted from the payload by using string interpolation. - `priority` object, nullable — Set the priority ID for the resulting incident. You can find the priority you want by calling the priorities endpoint. - `value` string, required — The priority ID. - `severity` object, nullable — Set the severity of the resulting alert. - `value` 'info' | 'warning' | 'error' | 'critical', required - `suppress` object — Set whether the resulting alert is suppressed. Can optionally be used with a threshold where resulting alerts will be suppressed until the threshold is met in a window of time. If using a threshold the rule must also set a route action. - `value` boolean, required - `threshold_value` integer — The number of occurences needed during the window of time to trigger the theshold. - `threshold_time_unit` 'seconds' | 'minutes' | 'hours' — The time unit for the window of time. - `threshold_time_amount` integer — The amount of time units for the window of time. - `suspend` object, nullable — Set the length of time to suspend the resulting alert before triggering. Rules with a suspend action must also set a route action, and cannot have a suppress with threshold action - `value` integer, required — The amount of time to suspend the alert in seconds. - `route` object, nullable — Set the service ID of the target service for the resulting alert. You can find the service you want to route to by calling the services endpoint. - `value` string, required — The target service's ID. - `rule_id` string, required — The id of the Event Rule to update. ## Response `200` The Event Rule that was updated. - object - `rule` EventRule - `id` string — ID of the Event Rule. - `self` string, url — the API show URL at which the object is accessible. - `disabled` boolean — Indicates whether the Event Rule is disabled and would therefore not be evaluated. - `conditions` object — Conditions evaluated to check if an event matches this Event Rule. Is always empty for the catch_all rule, though. - `operator` 'and' | 'or', required — Operator to combine sub-conditions. - `subconditions` object[], required — Array of sub-conditions. - `operator` 'exists' | 'nexists' | 'equals' | 'nequals' | 'contains' | 'ncontains' | 'matches' | 'nmatches', required — The type of operator to apply. - `parameters` object, required - `path` string, required — Path to a field in an event, in dot-notation. For Event Rules on a serivce, this will have to be a PD-CEF field. - `value` string, required — Value to apply to the operator. - `options` object — Options to configure the operator. - `time_frame` object — Time-based conditions for limiting when the rule is active. - `active_between` object — A fixed window of time during which the rule is active. - `start_time` integer, required — The start time in milliseconds. - `end_time` integer, required — End time in milliseconds. - `scheduled_weekly` object — A reccuring window of time based on the day of the week, during which the rule is active. - `start_time` integer, required — The amount of milliseconds into the day at which the window starts. - `duration` integer, required — The duration of the window in milliseconds. - `timezone` string, required — The timezone. - `weekdays` integer[], required — An array of day values. Ex [1, 3, 5] is Monday, Wednesday, Friday. - `variables` object[] — [Early Access] Populate variables from event payloads and use those variables in other event actions. - `type` 'regex', required — The type of operation to populate the variable. - `name` string, required — The name of the variable. - `parameters` object, required — The parameters for performing the operation to populate the - `value` string, required — The value for the operation. For example, an RE2 regular expression for regex-type variables. - `path` string, required — Path to a field in an event, in dot-notation. For Event Rules on a Service, this will have to be a PD-CEF field. - `position` integer — Position/index of the Event Rule in the Ruleset. Starting from position 0 (the first rule), rules are evaluated one-by-one until a matching rule is found. - `catch_all` boolean — Indicates whether the Event Rule is the last Event Rule of the Ruleset that serves as a catch-all. It has limited functionality compared to other rules and always matches. - `actions` object — When an event matches this Event Rule, the actions that will be taken to change the resulting Alert and Incident. - `annotate` object, nullable — Set a note on the resulting incident. - `value` string, required — The content of the note. - `event_action` object, nullable — Set whether the resulting alert status is trigger or resolve. - `value` 'trigger' | 'resolve', required - `extractions` union[] — Dynamically extract values to set and modify new and existing PD-CEF fields. - union - object - `target` string, required — The PD-CEF field that will be set with the value from the regex. - `source` string, required — The path to the event field where the regex will be applied to extract a value. - `regex` string, required — A RE2 regular expression. If it contains one or more capture groups, their values will be extracted and appended together. If it contains no capture groups, the whole match is used. - object - `target` string, required — The PD-CEF field that will be set with the value from the regex. - `template` string, required — A value that will be used to populate the target PD-CEF field. You can include variables extracted from the payload by using string interpolation. - `priority` object, nullable — Set the priority ID for the resulting incident. You can find the priority you want by calling the priorities endpoint. - `value` string, required — The priority ID. - `severity` object, nullable — Set the severity of the resulting alert. - `value` 'info' | 'warning' | 'error' | 'critical', required - `suppress` object — Set whether the resulting alert is suppressed. Can optionally be used with a threshold where resulting alerts will be suppressed until the threshold is met in a window of time. If using a threshold the rule must also set a route action. - `value` boolean, required - `threshold_value` integer — The number of occurences needed during the window of time to trigger the theshold. - `threshold_time_unit` 'seconds' | 'minutes' | 'hours' — The time unit for the window of time. - `threshold_time_amount` integer — The amount of time units for the window of time. - `suspend` object, nullable — Set the length of time to suspend the resulting alert before triggering. Rules with a suspend action must also set a route action, and cannot have a suppress with threshold action - `value` integer, required — The amount of time to suspend the alert in seconds. - `route` object, nullable — Set the service ID of the target service for the resulting alert. You can find the service you want to route to by calling the services endpoint. - `value` string, required — The target service's ID. ## Other responses - `400` — Caller provided invalid arguments. Please review the response for error details. Retrying with the same arguments will *not* work. - `401` — Caller did not supply credentials or did not provide the correct credentials. If you are using an API key, it may be invalid or your Authorization header may be malformed. - `403` — Caller is not authorized to view the requested resource. While your authentication is valid, the authenticated user or token does not have permission to perform this action. - `404` — The requested resource was not found. - `405` — The request was received and recognized by the server, but its HTTP method was rejected for the requested resource. - `409` — The request conflicts with the current state of the server. --- [API](https://skmtc.net/pagerduty/apis/rest-api.md) · [All operations](https://skmtc.net/pagerduty/apis/rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pagerduty/rest-api/revisions/b679a8f3f02c/schema)