---
title: "Update rule"
method: PUT
path: "/v0/rules/{id}"
tags: ["Rules"]
---

# Update rule

`PUT /v0/rules/{id}`

Update a rule to a new definition

## Path parameters

- `id` string, required — Rule ID

## Request body

- UpdateRuleInput
  - `action_ids` string[] — IDs of actions to run when the rule is triggered
  - `attack_types` string[] — Rule attack types
  - `authors` TypesRuleAuthor[] — Rule authors. Defaults to the user that made the request
    - `name` string — Name of a rule author
    - `twitter` string — Twitter handle for a rule author
  - `auto_review_auto_share` boolean — Whether auto-reviewed messages will be shared
  - `auto_review_classification` string, nullable — The classification auto-reviewed messages will have, when an auto-review action is associated with the rule
  - `description` string — Description of rule
  - `detection_methods` string[] — Rule detection technologies
  - `false_positives` string[] — Descriptions of known false positives that could occur
  - `internal_type` string, nullable — For core feed only
  - `label` string, nullable — Rule label
  - `maturity` string, nullable — Rule maturity
  - `name` string, required — Rule name
  - `references` string[] — URL references
  - `run_triage_on_excluded_messages` boolean, nullable — For Triage rules only, whether this rule will run even if the message matched a global exclusion.
  - `severity` string, nullable — Rule severity
  - `source` string, required — Source
  - `tactics_and_techniques` string[] — Rule tactics and techniques
  - `tags` string[] — Tags
  - `triage_abuse_reports` boolean, nullable — For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage_ field must be true.
  - `triage_classification_changes` boolean, nullable — For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage_ field must be true.
  - `triage_dlp_rule_matched` boolean, nullable — For Triage rules only, whether this rule will run for messages that matched a DLP rule. For triage rules, one triage_ field must be true.
  - `triage_flagged_messages` boolean, nullable — For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage_ field must be true.
  - `user_provided_tags` string[] — User-provided tags

## Response `200`

OK

- TypesAPIRule — Rule base
  - `action_ids` string[] — IDs of actions to run when the rule is triggered
  - `active` boolean — Indicates whether or not the rule is active and will flag matching messages
  - `attack_types` string[] — Rule attack types
  - `authors` TypesRuleAuthor[] — Rule authors
    - `name` string — Name of a rule author
    - `twitter` string — Twitter handle for a rule author
  - `auto_review_auto_share` boolean — Whether auto-reviewed messages will be shared
  - `auto_review_classification` 'malicious' | 'benign' | 'spam' | 'graymail' | 'simulation' | 'unwanted' | 'violation' | 'non-violation' — The classification auto-reviewed messages will have, when an auto-review action is associated with the rule
  - `created_at` string, date-time — Rule creation time
  - `description` string, required — Description of rule
  - `detection_methods` string[] — Rule detection technologies
  - `false_positives` string[] — Descriptions of known false positives that could occur
  - `id` string, uuid — Rule ID
  - `label` string — Rule label
  - `last_activated_at` string, date-time — When the rule was last activated
  - `maturity` string — Rule maturity
  - `name` string, required — Rule name
  - `passive` boolean — Indicates whether or not the rule is in passive mode
  - `references` string[] — URLs of reference resources for this rule
  - `run_triage_on_excluded_messages` boolean — For Triage rules only, whether this rule will run even if the message matched a global exclusion.
  - `severity` 'informational' | 'low' | 'medium' | 'high' | 'critical' — Rule severity
  - `source` string, required — Rule MQL (Message Query Language) source
  - `tactics_and_techniques` string[] — Rule tactics and techniques
  - `tags` string[] — Freeform tags for this rule (for example, "Executive Impersonation")
  - `triage_abuse_reports` boolean — For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage_ field must be true.
  - `triage_classification_changes` boolean — For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage_ field must be true.
  - `triage_dlp_rule_matched` boolean — For Triage rules only, whether this rule will run for messages that matched a DLP rule. For triage rules, one triage_ field must be true.
  - `triage_flagged_messages` boolean — For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage_ field must be true.
  - `type` string — Rule type
  - `updated_at` string, date-time — Rule last updated time

---

[API](https://skmtc.net/sublime/apis/sublime-platform-api.md) · [All operations](https://skmtc.net/sublime/apis/sublime-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sublime/sublime-platform-api/versions/d5df82850357/schema)