Help Center/SecMaster/API Reference/API/Playbook Rule Management/Creating a Playbook Rule
Updated on 2025-03-20 GMT+08:00
View PDF

Creating a Playbook Rule

Function

Creating a Playbook Rule

Calling Method

For details, see Calling APIs.

URI

POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{version_id}/rules

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Project ID.

workspace_id

Yes

String

Workspace ID

version_id

Yes

String

Playbook version ID.

Request Parameters

Table 2 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

User token.

It can be obtained by calling the IAM API used to obtain a user token. The value of X-Subject-Token in the response header is a token.

content-type

Yes

String

application/json;charset=UTF-8

Table 3 Request body parameters

Parameter

Mandatory

Type

Description

rule

Yes

ConditionInfo object

Details of playbook triggering rules

Table 4 ConditionInfo

Parameter

Mandatory

Type

Description

expression_type

No

String

Expression type. This parameter is mandatory for incident-triggered playbooks. The default value is common.

conditions

No

Array of ConditionItem objects

Triggering conditions. This parameter is mandatory for incident-triggered playbooks.

logics

No

Array of strings

Conditional logic combinations. This parameter is mandatory for incident-triggered playbooks.

cron

No

String

Cron expression (scheduled tasks). This parameter is mandatory for scheduled playbooks.

schedule_type

No

String

Scheduled task repetition type. The value can be second, hour, day, or week. This parameter is mandatory for scheduled playbooks.

start_type

No

String

Playbook execution type. The value can be IMMEDIATELY or CUSTOM. This parameter is mandatory for scheduled playbooks.

end_type

No

String

Playbook execution termination type. - FOREVER -- The playbook is executed all the time. - CUSTOM -- The playbook stops at a customized time. This parameter is mandatory for scheduled playbooks.

end_time

No

String

End time of a scheduled task. This parameter is mandatory for scheduled playbooks.

repeat_range

No

String

Execution time range, for example, 2021-01-30T23:00:00Z+0800. This parameter is mandatory for scheduled playbooks.

only_once

No

Boolean

Whether the operation is performed only once. This parameter is mandatory for scheduled playbooks.

execution_type

No

String

Execution queue type (PARALLEL -- The new task runs in parallel with the previous task). This parameter is mandatory for scheduled playbooks.

Table 5 ConditionItem

Parameter

Mandatory

Type

Description

name

No

String

Condition name.

detail

No

String

Condition details.

data

No

Array of strings

Condition expression data.

Response Parameters

Status code: 200

Table 6 Response header parameters

Parameter

Type

Description

X-request-id

String

Request ID, in the format request_uuid-timestamp-hostname.

Table 7 Response body parameters

Parameter

Type

Description

code

String

Error code

message

String

Error Message

data

RuleInfo object

Playbook triggering specifications information.

Table 8 RuleInfo

Parameter

Type

Description

id

String

Rule ID.

project_id

String

Project ID.

rule

String

Trigger rule.

Status code: 400

Table 9 Response header parameters

Parameter

Type

Description

X-request-id

String

Request ID, in the format request_uuid-timestamp-hostname.

Table 10 Response body parameters

Parameter

Type

Description

code

String

Error Code

message

String

Error Description

Example Requests

create a playbook rule named condition_0 and supporting all expression types.

{
  "rule" : {
    "expression_type" : "common",
    "conditions" : [ {
      "name" : "condition_0",
      "detail" : "Open",
      "data" : [ "handle_status, ==, Open" ]
    } ],
    "logics" : "[\"condition_0\"]"
  }
}

Example Responses

Status code: 200

Response when the request is successful.

{
  "code" : 0,
  "message" : "",
  "data" : {
    "id" : "909494e3-558e-46b6-a9eb-07a8e18ca62f",
    "project_id" : "909494e3-558e-46b6-a9eb-07a8e18ca62f",
    "rule" : "{\"expression_type\":\"common\",\"conditions\":[{\"name\":\"condition_0\",\"data\":[\"ref_order_id\",\"==\",\"123\"],\"detail\":\"123\"}],\"logics\":[\"condition_0\"]}"
  }
}

Status Codes

Status Code

Description

200

Response when the request is successful.

400

Response when the request failed.

Error Codes

See Error Codes.

Parent Topic: Playbook Rule Management