> Documentation index for AI agents: https://docs.pagerduty.com/llms.txt

# Get an Event Rule

`GET https://api.pagerduty.com/rulesets/{id}/rules/{rule_id}`

Get an Event Rule.
<!-- theme: warning -->
> ### End-of-life
> Rulesets and Event Rules will end-of-life soon. We highly recommend that you [migrate to Event Orchestration](https://support.pagerduty.com/docs/migrate-to-event-orchestration) as soon as possible so you can take advantage of the new functionality, such as improved UI, rule creation, APIs and Terraform support, advanced conditions, and rule nesting.

Rulesets allow you to route events to an endpoint and create collections of Event Rules, which define sets of actions to take based on event content.

For more information see the [API Concepts Document](https://docs.pagerduty.com/developer/api-concepts#rulesets)

Note: Create and Update on rules will accept 'description' or 'summary' interchangeably as an extraction action target. Get and List on rules will always return 'summary' as the target. If you are expecting 'description' please change your automation code to expect 'summary' instead.

Scoped OAuth requires: `event_rules.read`

## Authorization

- **api_key** (apiKey) — `Authorization` header. The API Key with format `Token token=<API_KEY>`

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `id` | string | yes | The ID of the resource. |
| `rule_id` | string | yes | The id of the Event Rule to retrieve. |

## Header parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `Accept` | string | yes | The `Accept` header is used as a versioning header. Default: `application/vnd.pagerduty+json;version=2`. |

## Response 200

The Event Rule object.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `rule` | object |  |  |
| `rule.id` | string |  | ID of the Event Rule. Read-only. |
| `rule.self` | string (url) |  | the API show URL at which the object is accessible. Read-only. |
| `rule.disabled` | boolean |  | Indicates whether the Event Rule is disabled and would therefore not be evaluated. |
| `rule.conditions` | object |  | Conditions evaluated to check if an event matches this Event Rule. Is always empty for the catch_all rule, though. |
| `rule.conditions.operator` | string | yes | Operator to combine sub-conditions. One of: `and`, `or`. |
| `rule.conditions.subconditions` | array of object | yes | Array of sub-conditions. |
| `rule.conditions.subconditions[].operator` | string | yes | The type of operator to apply. One of: `exists`, `nexists`, `equals`, `nequals`, `contains`, `ncontains`, `matches`, `nmatches`. |
| `rule.conditions.subconditions[].parameters` | object | yes |  |
| `rule.conditions.subconditions[].parameters.path` | string | yes | Path to a field in an event, in dot-notation. For Event Rules on a serivce, this will have to be a PD-CEF field. |
| `rule.conditions.subconditions[].parameters.value` | string | yes | Value to apply to the operator. |
| `rule.conditions.subconditions[].parameters.options` | object |  | Options to configure the operator. |
| `rule.time_frame` | object |  | Time-based conditions for limiting when the rule is active. |
| `rule.time_frame.active_between` | object |  | A fixed window of time during which the rule is active. |
| `rule.time_frame.active_between.start_time` | integer | yes | The start time in milliseconds. |
| `rule.time_frame.active_between.end_time` | integer | yes | End time in milliseconds. |
| `rule.time_frame.scheduled_weekly` | object |  | A reccuring window of time based on the day of the week, during which the rule is active. |
| `rule.time_frame.scheduled_weekly.start_time` | integer | yes | The amount of milliseconds into the day at which the window starts. |
| `rule.time_frame.scheduled_weekly.duration` | integer | yes | The duration of the window in milliseconds. |
| `rule.time_frame.scheduled_weekly.timezone` | string | yes | The timezone. |
| `rule.time_frame.scheduled_weekly.weekdays` | array of integer | yes | An array of day values. Ex [1, 3, 5] is Monday, Wednesday, Friday. |
| `rule.variables` | array of object |  | [Early Access] Populate variables from event payloads and use those variables in other event actions. |
| `rule.variables[].type` | string | yes | The type of operation to populate the variable. One of: `regex`. |
| `rule.variables[].name` | string | yes | The name of the variable. |
| `rule.variables[].parameters` | object | yes | The parameters for performing the operation to populate the. |
| `rule.variables[].parameters.value` | string | yes | The value for the operation. For example, an RE2 regular expression for regex-type variables. |
| `rule.variables[].parameters.path` | string | yes | Path to a field in an event, in dot-notation. For Event Rules on a Service, this will have to be a PD-CEF field. |
| `rule.position` | integer |  | Position/index of the Event Rule in the Ruleset. Starting from position 0 (the first rule), rules are evaluated one-by-one until a matching rule is found. |
| `rule.catch_all` | boolean |  | Indicates whether the Event Rule is the last Event Rule of the Ruleset that serves as a catch-all. It has limited functionality compared to other rules and always matches. Read-only. |
| `rule.actions` | object |  | When an event matches this rule, the actions that will be taken to change the resulting alert and incident. |
| `rule.actions.annotate` | object \| null |  | Set a note on the resulting incident. |
| `rule.actions.annotate.value` | string | yes | The content of the note. |
| `rule.actions.event_action` | object \| null |  | Set whether the resulting alert status is trigger or resolve. |
| `rule.actions.event_action.value` | string | yes | One of: `trigger`, `resolve`. |
| `rule.actions.extractions` | array of one of: object \| object |  | Dynamically extract values to set and modify new and existing PD-CEF fields. |
| `rule.actions.extractions[].target` | string | yes | (option 1) The PD-CEF field that will be set with the value from the regex. |
| `rule.actions.extractions[].source` | string | yes | (option 1) The path to the event field where the regex will be applied to extract a value. |
| `rule.actions.extractions[].regex` | string | yes | (option 1) A RE2 regular expression. If it contains one or more capture groups, their values will be extracted and appended together. If it contains no capture groups, the whole match is used. |
| `rule.actions.extractions[].target` | string | yes | (option 2) The PD-CEF field that will be set with the value from the regex. |
| `rule.actions.extractions[].template` | string | yes | (option 2) A value that will be used to populate the target PD-CEF field. You can include variables extracted from the payload by using string interpolation. |
| `rule.actions.priority` | object \| null |  | Set the priority ID for the resulting incident. You can find the priority you want by calling the priorities endpoint. |
| `rule.actions.priority.value` | string | yes | The priority ID. |
| `rule.actions.severity` | object \| null |  | Set the severity of the resulting alert. |
| `rule.actions.severity.value` | string | yes | One of: `info`, `warning`, `error`, `critical`. |
| `rule.actions.suppress` | object |  | Set whether the resulting alert is suppressed. Can optionally be used with a threshold where resulting alerts will be suppressed until the threshold is met in a window of time. If using a threshold the rule must also set a route action. |
| `rule.actions.suppress.value` | boolean | yes |  |
| `rule.actions.suppress.threshold_value` | integer |  | The number of occurences needed during the window of time to trigger the theshold. |
| `rule.actions.suppress.threshold_time_unit` | string |  | The time unit for the window of time. One of: `seconds`, `minutes`, `hours`. |
| `rule.actions.suppress.threshold_time_amount` | integer |  | The amount of time units for the window of time. |
| `rule.actions.suspend` | object \| null |  | Set the length of time to suspend the resulting alert before triggering. Rules with a suspend action must also set a route action, and cannot have a suppress with threshold action. |
| `rule.actions.suspend.value` | integer | yes | The amount of time to suspend the alert in seconds. |
| `rule.actions.route` | object \| null |  | Set the service ID of the target service for the resulting alert. You can find the service you want to route to by calling the services endpoint. |
| `rule.actions.route.value` | string | yes | The target service's ID. |

Example: Response Example

```json
{
  "rule": {
    "id": "14e56445-ebab-4dd0-ba9d-fc28a41b7e7b",
    "position": 0,
    "disabled": false,
    "catch_all": false,
    "self": "https://api.pagerduty.com/rulesets/0e84de00-9511-4380-9f4f-a7b568bb49a0/rules/14e56445-ebab-4dd0-ba9d-fc28a41b7e7b",
    "conditions": {
      "operator": "and",
      "subconditions": [
        {
          "operator": "contains",
          "parameters": {
            "value": "mysql",
            "path": "details.host"
          }
        }
      ]
    },
    "time_frame": {
      "active_between": {
        "start_time": 1577880000000,
        "end_time": 1580558400000
      }
    },
    "actions": {
      "annotate": {
        "value": "This incident was created by a Global Event Rule"
      },
      "route": {
        "value": "PI2KBWI"
      },
      "priority": {
        "value": "PCMUB6F"
      },
      "severity": {
        "value": "warning"
      },
      "extractions": [
        {
          "target": "dedup_key",
          "template": "{{error_level}} error on host {{host}}"
        }
      ]
    },
    "variables": [
      {
        "name": "error_level",
        "type": "regex",
        "parameters": {
          "value": ".*error level is (\\w+)\\.",
          "path": "payload.summary"
        }
      },
      {
        "name": "host",
        "type": "regex",
        "parameters": {
          "value": "(.*)-USW2",
          "path": "payload.host.human_name"
        }
      }
    ]
  }
}
```

## Response 400

Caller provided invalid arguments. Please review the response for error details. Retrying with the same arguments will *not* work.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 401

Caller did not supply credentials or did not provide the correct credentials.
If you are using an API key, it may be invalid or your Authorization header may be malformed.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 403

Caller is not authorized to view the requested resource.
While your authentication is valid, the authenticated user or token does not have permission to perform this action.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 404

The requested resource was not found.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Developer Agreement

Your access to and use of the PagerDuty Developer Services is governed by the [PagerDuty Developer Agreement](https://docs.pagerduty.com/developer/pagerduty-developer-agreement).