> Documentation index for AI agents: https://docs.pagerduty.com/llms.txt

# Get Event Enrichment rules

`GET https://api.pagerduty.com/enrichment/event_enrichments/{id}/rules`

Event Enrichments allow you to automatically add contextual data to events as they're ingested, so that relevant information is available throughout the event, alert, and incident lifecycle. By leveraging the Contextual Data Platform (CDP), you can define rules that extract values from events or query enrichment schemas to populate event fields.

<!-- theme: warning -->

> ### Early Access
> This API is in Early Access and may change at any time. Contact your PagerDuty account team to request access.

Get the rules associated with an Event Enrichment.

## Authorization

- **api_key** (apiKey) — `Authorization` header. The API Key with format `Token token=<API_KEY>`

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `id` | string | yes | The ID of the Event Enrichment. |

## Header parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `Accept` | string | yes | The `Accept` header is used as a versioning header. Default: `application/vnd.pagerduty+json;version=2`. |

## Response 200

The Event Enrichment rules (orchestration path).

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `orchestration_path` | object |  | The rules configuration for an Event Enrichment, represented as an orchestration path. |
| `orchestration_path.type` | string |  | The type of this orchestration path. Read-only. One of: `event_enrichment`. |
| `orchestration_path.parent` | object |  | Reference to the parent Event Enrichment. Read-only. |
| `orchestration_path.parent.id` | string |  | The ID of the Event Enrichment. |
| `orchestration_path.parent.type` | string |  | A string that determines the schema of the object. One of: `event_enrichment_reference`. |
| `orchestration_path.parent.summary` | string |  | A short-form, server-generated string that provides succinct, important information about an object suitable for primary labeling of an entity in a client. In many cases, this will be identical to `name`, though it is not intended to be an identifier. Read-only. |
| `orchestration_path.parent.self` | string (url) |  | The API show URL at which the object is accessible. Read-only. |
| `orchestration_path.self` | string (url) |  | The API show URL at which the object is accessible. Read-only. |
| `orchestration_path.sets` | array of object |  | An array of sets of rules. Must contain a set with id `start`. |
| `orchestration_path.sets[].id` | string |  | The ID of this set. The first set must have id `start`. |
| `orchestration_path.sets[].rules` | array of object |  | The rules in this set. |
| `orchestration_path.sets[].rules[].id` | string |  | The ID of this rule. Read-only. |
| `orchestration_path.sets[].rules[].label` | string |  | A description of this rule's purpose. |
| `orchestration_path.sets[].rules[].conditions` | array of object |  | Conditions that must be satisfied for this rule's actions to execute. |
| `orchestration_path.sets[].rules[].conditions[].expression` | string |  | A PCL condition expression. |
| `orchestration_path.sets[].rules[].actions` | one of: object \| object |  | Actions to perform when the rule conditions are met. Must be one of `extractions` or `enrichments`. |
| `orchestration_path.sets[].rules[].actions.extractions` | array of object | yes | (Extractions) Modify the event payload using regex-based extraction or template-based composition. Maximum 25 extractions per rule. |
| `orchestration_path.sets[].rules[].actions.extractions[].target` | string |  | The PD-CEF field to set with the extracted value. |
| `orchestration_path.sets[].rules[].actions.extractions[].template` | string \| null |  | A string template used to populate the target field. Supports event field interpolation. Used for template-based extraction. |
| `orchestration_path.sets[].rules[].actions.extractions[].source` | string |  | The path to the event field where the regex will be applied. Used for regex-based extraction. |
| `orchestration_path.sets[].rules[].actions.extractions[].regex` | string |  | A RE2 regular expression. If it contains capture groups, their values are extracted and appended. If no capture groups, the whole match is used. Used for regex-based extraction. |
| `orchestration_path.sets[].rules[].actions.enrichments` | array of object | yes | (Enrichments) Query a CDP enrichment schema using event values and write results back into the event payload. Maximum 1 enrichment action per rule; maximum 5 enrichment actions applied per event per Event Enrichment. |
| `orchestration_path.sets[].rules[].actions.enrichments[].schema_to_search` | string |  | The ID of the Enrichment Schema to query. |
| `orchestration_path.sets[].rules[].actions.enrichments[].search_values` | array of object |  | Configurations that specify how to read values from the event to query the Enrichment Schema. |
| `orchestration_path.sets[].rules[].actions.enrichments[].target` | string |  | The PD-CEF field to set with the data retrieved from the Enrichment Schema. |
| `orchestration_path.sets[].rules[].disabled` | boolean |  | Indicates whether the rule is disabled and would therefore not be evaluated. |
| `orchestration_path.created_at` | string (date-time) |  | The date/time the rules were created. Read-only. |
| `orchestration_path.created_by` | object \| null |  | Reference to the user that created the rules. Read-only. |
| `orchestration_path.created_by.id` | string |  | Read-only. |
| `orchestration_path.created_by.type` | string |  | Read-only. |
| `orchestration_path.created_by.self` | string (url) |  | Read-only. |
| `orchestration_path.updated_at` | string (date-time) |  | The date/time the rules were last updated. Read-only. |
| `orchestration_path.updated_by` | object \| null |  | Reference to the user that last updated the rules. Read-only. |
| `orchestration_path.updated_by.id` | string |  | Read-only. |
| `orchestration_path.updated_by.type` | string |  | Read-only. |
| `orchestration_path.updated_by.self` | string (url) |  | Read-only. |
| `orchestration_path.version` | string |  | Version of the rules configuration. Read-only. |

Example: Example Response

```json
{
  "orchestration_path": {
    "type": "event_enrichment",
    "parent": {
      "id": "AGN4PVDO2F5AZIVWETZ42I6IP4",
      "type": "event_enrichment_reference",
      "self": "https://api.pagerduty.com/enrichment/event_enrichments/AGN4PVDO2F5AZIVWETZ42I6IP4"
    },
    "self": "https://api.pagerduty.com/enrichment/event_enrichments/AGN4PVDO2F5AZIVWETZ42I6IP4/rules",
    "sets": [
      {
        "id": "start",
        "rules": [
          {
            "id": "ef760c4b",
            "label": "Enrich events that have an `Application:` in their summary",
            "conditions": [
              {
                "expression": "event.summary matches part 'Application:'"
              }
            ],
            "actions": {
              "enrichments": [
                {
                  "schema_to_search": "9f194d8d-0f58-4c5c-b1d2-a5adf7171821",
                  "search_values": [
                    {
                      "path": "event.custom_details.app",
                      "query_field_name": "app_name"
                    }
                  ],
                  "target": "event.custom_details.app_metadata"
                }
              ]
            }
          }
        ]
      }
    ],
    "created_at": "2026-02-04T20:02:23Z",
    "created_by": {
      "id": "P3HAR9Y",
      "type": "user_reference",
      "self": "https://api.pagerduty.com/users/P3HAR9Y"
    },
    "updated_at": "2026-02-10T23:53:48Z",
    "updated_by": null,
    "version": "1TpoWwY9xTKVAM2qYmiDl0kN.o9PBQDV"
  }
}
```

## Response 401

Caller did not supply credentials or did not provide the correct credentials.
If you are using an API key, it may be invalid or your Authorization header may be malformed.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 403

Caller is not authorized to view the requested resource.
While your authentication is valid, the authenticated user or token does not have permission to perform this action.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 404

The requested resource was not found.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 429

Too many requests have been made, the rate limit has been reached.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 500

Internal Server Error the PagerDuty server experienced an error.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Developer Agreement

Your access to and use of the PagerDuty Developer Services is governed by the [PagerDuty Developer Agreement](https://docs.pagerduty.com/developer/pagerduty-developer-agreement).