Skip to main content
List all loaded detection rules.

​
Endpoint

GET /api/v1/rules

​
Example Request

curl http://localhost:8000/api/v1/rules

​
Response

{
  "count": 37,
  "rules": [
    {
      "name": "high_value_transfer",
      "description": "Detect large ETH transfers",
      "condition": "tx.value > 100 ether",
      "output": "Large transfer: %tx.value_eth ETH",
      "priority": "WARNING",
      "enabled": true,
      "tags": ["high-value", "transfer"],
      "chains": ["ethereum"],
      "references": ["https://example.com/threat-intel"]
    },
    ...
  ]
}

​
Response Fields

FieldTypeDescription
countnumberTotal number of rules
rulesarrayArray of rule objects
rules[].namestringRule name (unique identifier)
rules[].descriptionstringRule description
rules[].conditionstringDetection condition expression
rules[].outputstringAlert output template with placeholders
rules[].prioritystringPriority level (NOTICE, WARNING, CRITICAL)
rules[].enabledbooleanWhether rule is enabled
rules[].tagsarrayRule tags for categorization
rules[].chainsarrayBlockchain networks this rule applies to (empty = all)
rules[].referencesarrayOptional threat intelligence links