{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/runpanther-io/json-schema/runpanther-io-post-rules-request-schema.json",
  "title": "PostRulesRequest",
  "x-generated": "2026-10-29",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_ae-authored/runpanther-io-openapi-generated.yml#/components/schemas/PostRulesRequest",
  "type": "object",
  "properties": {
    "body": {
      "type": "string",
      "description": "The python body of the rule"
    },
    "createAlert": {
      "type": "boolean",
      "description": "Determines whether the rule should create alerts when it triggers"
    },
    "dedupPeriodMinutes": {
      "type": "integer",
      "description": "The amount of time in minutes for grouping alerts"
    },
    "description": {
      "type": "string",
      "description": "The description of the rule"
    },
    "displayName": {
      "type": "string",
      "description": "The display name of the rule"
    },
    "enabled": {
      "type": "boolean",
      "description": "Determines whether or not the rule is active"
    },
    "id": {
      "type": "string",
      "description": "The id of the rule"
    },
    "inlineFilters": {
      "type": "string",
      "description": "The filter for the rule represented in YAML"
    },
    "logTypes": {
      "type": "array",
      "description": "log types"
    },
    "managed": {
      "type": "boolean",
      "description": "Determines if the rule is managed by panther"
    },
    "outputIDs": {
      "type": "array",
      "description": "Destination IDs that override default alert routing based on severity"
    },
    "reference": {
      "type": "string",
      "description": "A URL or note for additional reference material"
    },
    "reports": {
      "type": "object",
      "description": "reports"
    },
    "runbook": {
      "type": "string",
      "description": "How to handle the generated alert"
    },
    "severity": {
      "type": "string",
      "description": "Severity level"
    },
    "summaryAttributes": {
      "type": "array",
      "description": "A list of fields in the event to create top 5 summaries for"
    },
    "tags": {
      "type": "array",
      "description": "The tags for the rule"
    },
    "tests": {
      "type": "array",
      "description": "Unit tests for the Rule. Best practice is to include a positive and negative case"
    },
    "threshold": {
      "type": "integer",
      "description": "the number of events that must match before an alert is triggered"
    }
  },
  "required": [
    "body",
    "id",
    "severity"
  ]
}