---
title: "Retrieve history of a rule"
method: GET
path: "/v0/rules/{id}/rule-history"
tags: ["Rules"]
---

# Retrieve history of a rule

`GET /v0/rules/{id}/rule-history`

Retrieve history of a rule

## Path parameters

- `id` string, uuid, required — Rule ID

## Query parameters

- `classification_created_at[gte]` string, date-time, nullable — Filter by classifications made after this datetime
- `classification_created_at[lte]` string, date-time, nullable — Filter by classifications made before this datetime
- `use_rule_last_updated_as_created_at` boolean, nullable — Filter by classifications made since the rule has been updated

## Response `200`

OK

- HandlerTypesRuleHistoryResponse
  - `actions` TypesSqarAction[] — Actions associated with the rule
    - `active` boolean
    - `id` string
    - `name` string
    - `type` string
  - `flagged_message_groups_report` HandlerTypesRuleHistoryStats — Rule history stats for message groups
    - `classified_detection_rate` number, double, nullable — The percentage of classified detections
    - `count_classified_benign` integer — Total number of classified benign rule history entries
    - `count_classified_graymail` integer — Total number of classified graymail rule history entries
    - `count_classified_malicious` integer — Total number of classified malicious rule history entries
    - `count_classified_no_reason` integer — Total number of classified no reason rule history entries
    - `count_classified_simulation` integer — Total number of classified simulation rule history entries
    - `count_classified_unwanted` integer — Total number of classified unwanted rule history entries
    - `count_unreviewed` integer — Total number of unreviewed rule history entries
    - `total` integer — Total number of rule history entries
  - `rule` TypesAPIRule — Rule base
    - `action_ids` string[] — IDs of actions to run when the rule is triggered
    - `active` boolean — Indicates whether or not the rule is active and will flag matching messages
    - `attack_types` string[] — Rule attack types
    - `authors` TypesRuleAuthor[] — Rule authors
      - `name` string — Name of a rule author
      - `twitter` string — Twitter handle for a rule author
    - `auto_review_auto_share` boolean — Whether auto-reviewed messages will be shared
    - `auto_review_classification` 'malicious' | 'benign' | 'spam' | 'graymail' | 'simulation' | 'unwanted' | 'violation' | 'non-violation' — The classification auto-reviewed messages will have, when an auto-review action is associated with the rule
    - `created_at` string, date-time — Rule creation time
    - `description` string, required — Description of rule
    - `detection_methods` string[] — Rule detection technologies
    - `false_positives` string[] — Descriptions of known false positives that could occur
    - `id` string, uuid — Rule ID
    - `label` string — Rule label
    - `last_activated_at` string, date-time — When the rule was last activated
    - `maturity` string — Rule maturity
    - `name` string, required — Rule name
    - `passive` boolean — Indicates whether or not the rule is in passive mode
    - `references` string[] — URLs of reference resources for this rule
    - `run_triage_on_excluded_messages` boolean — For Triage rules only, whether this rule will run even if the message matched a global exclusion.
    - `severity` 'informational' | 'low' | 'medium' | 'high' | 'critical' — Rule severity
    - `source` string, required — Rule MQL (Message Query Language) source
    - `tactics_and_techniques` string[] — Rule tactics and techniques
    - `tags` string[] — Freeform tags for this rule (for example, "Executive Impersonation")
    - `triage_abuse_reports` boolean — For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage_ field must be true.
    - `triage_classification_changes` boolean — For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage_ field must be true.
    - `triage_dlp_rule_matched` boolean — For Triage rules only, whether this rule will run for messages that matched a DLP rule. For triage rules, one triage_ field must be true.
    - `triage_flagged_messages` boolean — For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage_ field must be true.
    - `type` string — Rule type
    - `updated_at` string, date-time — Rule last updated time

---

[API](https://skmtc.net/sublime/apis/sublime-platform-api.md) · [All operations](https://skmtc.net/sublime/apis/sublime-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sublime/sublime-platform-api/versions/d5df82850357/schema)