--- title: Update an incident rule description: Update an incident rule. breadcrumbs: Documentación > API > Update an incident rule --- > For the complete documentation index, see [llms.txt](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/llms.txt). # Update an incident rule ## v2 (latest) {% alert level="warning" %} **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help.md). {% /alert %} | Datadog site | API endpoint | | ----------------- | --------------------------------------------------------------------------- | | app.datadoghq.com | PATCH https://api.datadoghq.com/api/v2/incidents/config/rules/{rule_id} | | us3.datadoghq.com | PATCH https://api.us3.datadoghq.com/api/v2/incidents/config/rules/{rule_id} | | us5.datadoghq.com | PATCH https://api.us5.datadoghq.com/api/v2/incidents/config/rules/{rule_id} | | app.datadoghq.eu | PATCH https://api.datadoghq.eu/api/v2/incidents/config/rules/{rule_id} | | ap1.datadoghq.com | PATCH https://api.ap1.datadoghq.com/api/v2/incidents/config/rules/{rule_id} | | ap2.datadoghq.com | PATCH https://api.ap2.datadoghq.com/api/v2/incidents/config/rules/{rule_id} | | uk1.datadoghq.com | PATCH https://api.uk1.datadoghq.com/api/v2/incidents/config/rules/{rule_id} | | app.ddog-gov.com | PATCH https://api.ddog-gov.com/api/v2/incidents/config/rules/{rule_id} | | us2.ddog-gov.com | PATCH https://api.us2.ddog-gov.com/api/v2/incidents/config/rules/{rule_id} | ### Overview Update an incident rule. This endpoint requires any of the following permissions: - `incident_settings_write` - `incident_notification_settings_write` OAuth apps require the `incident_settings_write` authorization [scope](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/es/api/latest/scopes.md#incidents) to access this endpoint. ### Arguments #### Path Parameters | Field | Type | Description | | -------------------- | ------ | ------------------------------ | | rule_id [*required*] | string | The UUID of the incident rule. | ### Request #### Body Data (required) Incident rule patch payload. {% tabs %} {% tab label="Model" %} | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | object | Incident rule data in a patch request. | | data | attributes | object | Attributes for patching an incident rule. All fields are optional. | | attributes | condition | object | A query-based condition for an incident rule. | | condition | normalized_query | string | The normalized query string. | | condition | raw_query | string | The raw query string. | | attributes | conditions | [object] | List of field-based conditions. | | conditions | field [*required*] | string | The field to match on. | | conditions | values [*required*] | [string] | The values to match. | | attributes | enabled | boolean | Whether the rule is enabled. | | attributes | task_payload | string | The JSON-encoded payload for the task. | | attributes | trigger | enum | The trigger event for an incident rule. Allowed enum values: `incident_saved_trigger`, `incident_created_trigger`, `incident_modified_trigger`. | | data | id [*required*] | uuid | The rule identifier. | | data | type [*required*] | enum | Incident rule resource type. Allowed enum values: `incident_rules`. | {% /tab %} {% tab label="Example" %} ```json { "data": { "attributes": { "condition": { "normalized_query": "severity:SEV-1", "raw_query": "severity:SEV-1" }, "conditions": [ { "field": "severity", "values": [ "SEV-1", "SEV-2" ] } ], "enabled": true, "task_payload": "{}", "trigger": "incident_created_trigger" }, "id": "00000000-0000-0000-0000-000000000000", "type": "incident_rules" } } ``` {% /tab %} {% /tabs %} ### Response {% tabs %} {% tab label="200" %} OK {% tabs %} {% tab label="Model" %} Response with a single incident rule. | Parent field | Field | Type | Description | | ------------ | ---------------------------------- | --------- | ----------------------------------------------------------------------------- | | | data [*required*] | object | Incident rule data in a response. | | data | attributes [*required*] | object | Attributes of an incident rule in a response. | | attributes | condition | object | A query-based condition for an incident rule. | | condition | normalized_query | string | The normalized query string. | | condition | raw_query | string | The raw query string. | | attributes | condition_table_type | int64 | The condition table type. | | attributes | conditions | [object] | List of field-based conditions. | | conditions | field [*required*] | string | The field to match on. | | conditions | values [*required*] | [string] | The values to match. | | attributes | created | date-time | Timestamp when the rule was created. | | attributes | created_by_uuid | uuid | UUID of the user who created the rule. | | attributes | deleted | date-time | Timestamp when the rule was deleted. | | attributes | enabled | boolean | Whether the rule is enabled. | | attributes | execution_type | int64 | The execution type of the rule. | | attributes | incident_settings_association_uuid | uuid | The incident settings association UUID. | | attributes | match_any_condition | boolean | Whether any condition should match. | | attributes | modified | date-time | Timestamp when the rule was last modified. | | attributes | modified_by_uuid | uuid | UUID of the user who last modified the rule. | | attributes | org_id | int64 | The organization ID. | | attributes | task_id | string | The task ID. | | attributes | task_payload | string | The JSON-encoded task payload. | | attributes | trigger | string | The trigger event for the rule. | | data | id [*required*] | uuid | The rule identifier. | | data | type [*required*] | enum | Incident rule response resource type. Allowed enum values: `incidents_rules`. | {% /tab %} {% tab label="Example" %} ```json { "data": { "attributes": { "condition": { "normalized_query": "severity:SEV-1", "raw_query": "severity:SEV-1" }, "condition_table_type": 1, "conditions": [ { "field": "severity", "values": [ "SEV-1", "SEV-2" ] } ], "created": "2024-01-01T00:00:00.000Z", "created_by_uuid": "00000000-0000-0000-0000-000000000001", "deleted": null, "enabled": true, "execution_type": 1, "incident_settings_association_uuid": null, "match_any_condition": false, "modified": "2024-01-01T00:00:00.000Z", "modified_by_uuid": "00000000-0000-0000-0000-000000000001", "org_id": 123456, "task_id": "notify-incident-handles-job", "task_payload": "{}", "trigger": "incident_created_trigger" }, "id": "00000000-0000-0000-0000-000000000000", "type": "incidents_rules" } } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="400" %} Bad Request {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="401" %} Unauthorized {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="403" %} Forbidden {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="404" %} Not Found {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="429" %} Too many requests {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% /tabs %} ### Code Example {% tabs %} {% tab label="Curl" %} ```bash # Path parameters export rule_id="CHANGE_ME" # Set your Datadog site and credentials export DD_SITE="datadoghq.com" # Or us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com, ddog-gov.com, us2.ddog-gov.com # Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" curl -X PATCH "https://api.${DD_SITE}/api/v2/incidents/config/rules/${rule_id}" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ -d @- << EOF { "data": { "attributes": { "enabled": false }, "id": "00000000-0000-0000-0000-000000000001", "type": "incident_rules" } } EOF ``` {% /tab %} {% /tabs %}