Skip to main content
POST
Create a policy override

Authorizations

Authorization
string
header
required

API key for authentication. Make sure to include the word apikey, followed by a single space and then your token. Example: apikey 1234_abcdef

Path Parameters

domain_id
integer
required

The domain ID

Body

application/json
name
string
required

The policy override's display name

Required string length: 1 - 100
target_type
enum<string>
required

Whether target_ids are detector IDs or rule IDs

Available options:
detector,
rule
target_ids
integer[]
required

The detectors or rules this override suppresses

Minimum array length: 1

A detector or rule ID, matching target_type

enabled
boolean
required

Whether the override is active

description
string | null

An optional note explaining the override

Maximum string length: 1000
conditions
PolicyOverrideCondition · object[]

The conditions required for the override to apply. An override may have up to 5 conditions; all must pass for the override to apply. Without conditions the override applies to every request on the owning domain that hits a linked target.

Maximum array length: 5
request_id
string | null

The ID of the request that prompted this override, if created from Event Details. Preserves a snapshot of that request for audit purposes; has no effect on override behavior and is not returned by this API.

Pattern: ^[a-f0-9]{32}-[0-9]{6}$

Response

Successful Response

id
integer
required

The policy override's ID

domain_id
integer
required

The domain this override belongs to

name
string
required

The policy override's display name

target_type
enum<string>
required

Whether targets are detectors or rules

Available options:
detector,
rule
targets
PolicyOverrideTarget · object[]
required

The detectors or rules this override suppresses

conditions
PolicyOverrideCondition · object[]
required

The conditions required for the override to apply. Empty means the override applies to every request on the owning domain that hits a linked target.

enabled
boolean
required

Whether the override is active

stale
boolean
required

Whether a linked target has been deleted, disabled, or otherwise become invalid. A stale override is not published and does not suppress anything until it's edited.

created_at
string<date-time>
required

When the override was created

updated_at
string<date-time>
required

When the override was last updated

description
string | null

An optional note explaining the override