---
title: "Validate rule"
method: POST
path: "/v0/rules/validate"
tags: ["Rules"]
---

# Validate rule

`POST /v0/rules/validate`

Validate a rule (MQL, YAML fields, etc). When run against the sandbox or analyzer, no auth is needed but custom lists etc will not be available.

## Request body

- ValidateRuleInput
  - `action_ids` string[] — IDs of actions to run when the rule is triggered
  - `active` boolean — Activate the rule immediately
  - `attack_types` string[] — Rule attack types
  - `authors` TypesRuleAuthor[] — Rule authors. Defaults to the user that made the request
    - `name` string — Name of a rule author
    - `twitter` string — Twitter handle for a rule author
  - `auto_review_auto_share` boolean — Whether auto-reviewed messages will be shared
  - `auto_review_classification` string, nullable — The classification auto-reviewed messages will have, when an auto-review action is associated with the rule
  - `description` string — Description of rule
  - `detection_methods` string[] — Rule detection technologies
  - `false_positives` string[] — Descriptions of known false positives that could occur
  - `internal_type` string, nullable — For core feed only
  - `label` string, nullable — Rule label
  - `maturity` string, nullable — Rule maturity
  - `name` string, required — Rule name
  - `references` string[] — URL references
  - `run_triage_on_excluded_messages` boolean, nullable — For Triage rules only, whether this rule will run even if the message matched a global exclusion.
  - `severity` string, nullable — Rule severity
  - `source` string, required — Source
  - `tactics_and_techniques` string[] — Rule tactics and techniques
  - `tags` string[] — Tags
  - `triage_abuse_reports` boolean, nullable — For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage_ field must be true.
  - `triage_classification_changes` boolean, nullable — For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage_ field must be true.
  - `triage_dlp_rule_matched` boolean, nullable — For Triage rules only, whether this rule will run for messages that matched a DLP rule. For triage rules, one triage_ field must be true.
  - `triage_flagged_messages` boolean, nullable — For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage_ field must be true.
  - `type` 'detection' | 'dlp' | 'triage' — Type of the rule
  - `user_provided_tags` string[] — User-provided tags

## Response `200`

OK

- HandlerTypesValidateRuleResponse
  - `functions` string[] — Function names found in the rule
  - `is_org_dependent` boolean — Whether the rule uses org-specific fields, lists, or functions
  - `list` string[] — List names found in the rule
  - `validation_error` string — Validation error message if the rule is invalid

---

[API](https://skmtc.net/sublime/apis/sublime-platform-api.md) · [All operations](https://skmtc.net/sublime/apis/sublime-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sublime/sublime-platform-api/versions/d5df82850357/schema)