Skip to main content
Get full details of a specific detection rule by name.

​
Endpoint

GET /api/v1/rules/:name

​
Path Parameters

ParameterTypeDescription
namestringRule name (URL-encoded if needed)

​
Example Request

curl http://localhost:8000/api/v1/rules/high_value_transfer

​
Response

{
  "name": "high_value_transfer",
  "description": "Detect large ETH transfers",
  "condition": "tx.value > 100 ether",
  "output": "Large transfer: %tx.value_eth ETH",
  "priority": "WARNING",
  "enabled": true,
  "tags": ["high-value", "transfer"],
  "chains": ["ethereum"],
  "references": ["https://example.com/threat-intel"],
  "file_path": "./rules/default/high_value_transfers.yaml"
}

​
Response Fields

FieldTypeDescription
namestringRule name (unique identifier)
descriptionstringRule description
conditionstringDetection condition expression
outputstringAlert output template with placeholders
prioritystringPriority level (NOTICE, WARNING, CRITICAL)
enabledbooleanWhether rule is enabled
tagsarrayRule tags for categorization
chainsarrayBlockchain networks this rule applies to
referencesarrayOptional threat intelligence links
file_pathstringOptional path to rule file