--- title: Create an incident rule description: Create an incident rule. breadcrumbs: Docs > API > Create an incident rule --- > For the complete documentation index, see [llms.txt](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/llms.txt). # Create an incident rule ## v2 (latest) {% alert level="warning" %} **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help.md). {% /alert %} | Datadog site | API endpoint | | ----------------- | ---------------------------------------------------------------- | | app.datadoghq.com | POST https://api.datadoghq.com/api/v2/incidents/config/rules | | us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/incidents/config/rules | | us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/incidents/config/rules | | app.datadoghq.eu | POST https://api.datadoghq.eu/api/v2/incidents/config/rules | | ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/incidents/config/rules | | ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/incidents/config/rules | | uk1.datadoghq.com | POST https://api.uk1.datadoghq.com/api/v2/incidents/config/rules | | app.ddog-gov.com | POST https://api.ddog-gov.com/api/v2/incidents/config/rules | | us2.ddog-gov.com | POST https://api.us2.ddog-gov.com/api/v2/incidents/config/rules | ### Overview Create an incident rule. This endpoint requires any of the following permissions: - `incident_settings_write` - `incident_notification_settings_write` OAuth apps require the `incident_settings_write` authorization [scope](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/scopes.md#incidents) to access this endpoint. ### Request #### Body Data (required) Incident rule payload. {% tabs %} {% tab label="Model" %} | Parent field | Field | Type | Description | | ------------ | --------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | object | Incident rule data in a create request. | | data | attributes [*required*] | object | Attributes for creating an incident rule. | | attributes | condition [*required*] | object | A query-based condition for an incident rule. | | condition | normalized_query | string | The normalized query string. | | condition | raw_query | string | The raw query string. | | attributes | condition_table_type [*required*] | int64 | The condition table type. 1 = raw query. | | attributes | conditions | [object] | List of field-based conditions. | | conditions | field [*required*] | string | The field to match on. | | conditions | values [*required*] | [string] | The values to match. | | attributes | enabled [*required*] | boolean | Whether the rule is enabled. | | attributes | execution_type [*required*] | enum | The execution type of an incident rule. Allowed enum values: `1`, `2`. | | attributes | incident_type_uuid | uuid | The UUID of the incident type this rule applies to. | | attributes | match_any_condition | boolean | Whether any condition (OR logic) should match instead of all (AND logic). | | attributes | task_id [*required*] | enum | The task ID for an incident rule. Allowed enum values: `jira-create-issue-job`, `notify-incident-handles-job`, `servicenow-create-incident-job`, `slack-create-channel-job`, `zoom-create-meeting-job`, `google-meet-create-meeting-job`, `workflow-automation-job`, `ms-teams-create-meeting-job`, `google-chat-create-space-job`, `zoom-suppress-summarization-job`, `ms-teams-suppress-summarization-job`, `google-meet-suppress-summarization-job`. | | attributes | task_payload [*required*] | string | The JSON-encoded payload for the task. | | attributes | trigger | enum | The trigger event for an incident rule. Allowed enum values: `incident_saved_trigger`, `incident_created_trigger`, `incident_modified_trigger`. | | data | type [*required*] | enum | Incident rule resource type. Allowed enum values: `incident_rules`. | {% /tab %} {% tab label="Example" %} ```json { "data": { "attributes": { "condition": { "normalized_query": "severity:SEV-1", "raw_query": "severity:SEV-1" }, "condition_table_type": 1, "conditions": [ { "field": "severity", "values": [ "SEV-1", "SEV-2" ] } ], "enabled": true, "execution_type": 1, "incident_type_uuid": "00000000-0000-0000-0000-000000000000", "match_any_condition": false, "task_id": "notify-incident-handles-job", "task_payload": "{}", "trigger": "incident_created_trigger" }, "type": "incident_rules" } } ``` {% /tab %} {% /tabs %} ### Response {% tabs %} {% tab label="201" %} Created {% tabs %} {% tab label="Model" %} Response with a single incident rule. | Parent field | Field | Type | Description | | ------------ | ---------------------------------- | --------- | ----------------------------------------------------------------------------- | | | data [*required*] | object | Incident rule data in a response. | | data | attributes [*required*] | object | Attributes of an incident rule in a response. | | attributes | condition | object | A query-based condition for an incident rule. | | condition | normalized_query | string | The normalized query string. | | condition | raw_query | string | The raw query string. | | attributes | condition_table_type | int64 | The condition table type. | | attributes | conditions | [object] | List of field-based conditions. | | conditions | field [*required*] | string | The field to match on. | | conditions | values [*required*] | [string] | The values to match. | | attributes | created | date-time | Timestamp when the rule was created. | | attributes | created_by_uuid | uuid | UUID of the user who created the rule. | | attributes | deleted | date-time | Timestamp when the rule was deleted. | | attributes | enabled | boolean | Whether the rule is enabled. | | attributes | execution_type | int64 | The execution type of the rule. | | attributes | incident_settings_association_uuid | uuid | The incident settings association UUID. | | attributes | match_any_condition | boolean | Whether any condition should match. | | attributes | modified | date-time | Timestamp when the rule was last modified. | | attributes | modified_by_uuid | uuid | UUID of the user who last modified the rule. | | attributes | org_id | int64 | The organization ID. | | attributes | task_id | string | The task ID. | | attributes | task_payload | string | The JSON-encoded task payload. | | attributes | trigger | string | The trigger event for the rule. | | data | id [*required*] | uuid | The rule identifier. | | data | type [*required*] | enum | Incident rule response resource type. Allowed enum values: `incidents_rules`. | {% /tab %} {% tab label="Example" %} ```json { "data": { "attributes": { "condition": { "normalized_query": "severity:SEV-1", "raw_query": "severity:SEV-1" }, "condition_table_type": 1, "conditions": [ { "field": "severity", "values": [ "SEV-1", "SEV-2" ] } ], "created": "2024-01-01T00:00:00.000Z", "created_by_uuid": "00000000-0000-0000-0000-000000000001", "deleted": null, "enabled": true, "execution_type": 1, "incident_settings_association_uuid": null, "match_any_condition": false, "modified": "2024-01-01T00:00:00.000Z", "modified_by_uuid": "00000000-0000-0000-0000-000000000001", "org_id": 123456, "task_id": "notify-incident-handles-job", "task_payload": "{}", "trigger": "incident_created_trigger" }, "id": "00000000-0000-0000-0000-000000000000", "type": "incidents_rules" } } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="400" %} Bad Request {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="401" %} Unauthorized {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="403" %} Forbidden {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="429" %} Too many requests {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% /tabs %} ### Code Example {% tabs %} {% tab label="Curl" %} ```bash # Set your Datadog site and credentials export DD_SITE="datadoghq.com" # Or us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com, ddog-gov.com, us2.ddog-gov.com # Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" curl -X POST "https://api.${DD_SITE}/api/v2/incidents/config/rules" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ -d @- << EOF { "data": { "attributes": { "condition": { "raw_query": "severity:SEV-1" }, "condition_table_type": 1, "enabled": true, "execution_type": 1, "task_id": "notify-incident-handles-job", "task_payload": "{}", "trigger": "incident_created_trigger" }, "type": "incident_rules" } } EOF ``` {% /tab %} {% /tabs %}