Endpoint
GET /api/v1/rules
Example Request
curl http://localhost:8000/api/v1/rules
Response
{
"count": 37,
"rules": [
{
"name": "high_value_transfer",
"description": "Detect large ETH transfers",
"condition": "tx.value > 100 ether",
"output": "Large transfer: %tx.value_eth ETH",
"priority": "WARNING",
"enabled": true,
"tags": ["high-value", "transfer"],
"chains": ["ethereum"],
"references": ["https://example.com/threat-intel"]
},
...
]
}
Response Fields
| Field | Type | Description |
|---|---|---|
count | number | Total number of rules |
rules | array | Array of rule objects |
rules[].name | string | Rule name (unique identifier) |
rules[].description | string | Rule description |
rules[].condition | string | Detection condition expression |
rules[].output | string | Alert output template with placeholders |
rules[].priority | string | Priority level (NOTICE, WARNING, CRITICAL) |
rules[].enabled | boolean | Whether rule is enabled |
rules[].tags | array | Rule tags for categorization |
rules[].chains | array | Blockchain networks this rule applies to (empty = all) |
rules[].references | array | Optional threat intelligence links |