--- title: Create an incident rule description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > API Reference > Incidents --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Create an incident rule{% #create-an-incident-rule %} Copy pageCopied {% tab title="v2" %} **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). | Datadog site | API endpoint | | ----------------- | ---------------------------------------------------------------- | | ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/incidents/config/rules | | ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/incidents/config/rules | | app.datadoghq.eu | POST https://api.datadoghq.eu/api/v2/incidents/config/rules | | app.ddog-gov.com | POST https://api.ddog-gov.com/api/v2/incidents/config/rules | | us2.ddog-gov.com | POST https://api.us2.ddog-gov.com/api/v2/incidents/config/rules | | uk1.datadoghq.com | POST https://api.uk1.datadoghq.com/api/v2/incidents/config/rules | | app.datadoghq.com | POST https://api.datadoghq.com/api/v2/incidents/config/rules | | us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/incidents/config/rules | | us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/incidents/config/rules | ### Overview Create an incident rule. This endpoint requires any of the following permissions: `incident_settings_write``incident_notification_settings_write` OAuth apps require the `incident_settings_write` authorization [scope](https://docs.datadoghq.com/api/latest/scopes.md#incidents) to access this endpoint. ### Request #### Body Data (required) Incident rule payload. {% tab title="Model" %} | Parent field | Field | Type | Description | | ------------ | -------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | data [*required*] | object | Incident rule data in a create request. | | data | attributes [*required*] | object | Attributes for creating an incident rule. | | attributes | condition [*required*] | object | A query-based condition for an incident rule. | | condition | normalized_query | string | The normalized query string. | | condition | raw_query | string | The raw query string. | | attributes | condition_table_type [*required*] | int64 | The condition table type. 1 = raw query. | | attributes | conditions | [object] | List of field-based conditions. | | conditions | field [*required*] | string | The field to match on. | | conditions | values [*required*] | [string] | The values to match. | | attributes | enabled [*required*] | boolean | Whether the rule is enabled. | | attributes | execution_type [*required*] | enum | The execution type of an incident rule. Allowed enum values: `1,2` | | attributes | incident_type_uuid | uuid | The UUID of the incident type this rule applies to. | | attributes | match_any_condition | boolean | Whether any condition (OR logic) should match instead of all (AND logic). | | attributes | task_id [*required*] | enum | The task ID for an incident rule. Allowed enum values: `jira-create-issue-job,notify-incident-handles-job,servicenow-create-incident-job,slack-create-channel-job,zoom-create-meeting-job,google-meet-create-meeting-job,workflow-automation-job,ms-teams-create-meeting-job,google-chat-create-space-job,zoom-suppress-summarization-job` | | attributes | task_payload [*required*] | string | The JSON-encoded payload for the task. | | attributes | trigger | enum | The trigger event for an incident rule. Allowed enum values: `incident_saved_trigger,incident_created_trigger,incident_modified_trigger` | | data | type [*required*] | enum | Incident rule resource type. Allowed enum values: `incident_rules` | {% /tab %} {% tab title="Example" %} ```json { "data": { "attributes": { "condition": { "normalized_query": "severity:SEV-1", "raw_query": "severity:SEV-1" }, "condition_table_type": 1, "conditions": [ { "field": "severity", "values": [ "SEV-1", "SEV-2" ] } ], "enabled": true, "execution_type": 1, "incident_type_uuid": "00000000-0000-0000-0000-000000000000", "match_any_condition": false, "task_id": "notify-incident-handles-job", "task_payload": "{}", "trigger": "incident_created_trigger" }, "type": "incident_rules" } } ``` {% /tab %} ### Response {% tab title="201" %} Created {% tab title="Model" %} Response with a single incident rule. | Parent field | Field | Type | Description | | ------------ | ---------------------------------- | --------- | ---------------------------------------------------------------------------- | | | data [*required*] | object | Incident rule data in a response. | | data | attributes [*required*] | object | Attributes of an incident rule in a response. | | attributes | condition | object | A query-based condition for an incident rule. | | condition | normalized_query | string | The normalized query string. | | condition | raw_query | string | The raw query string. | | attributes | condition_table_type | int64 | The condition table type. | | attributes | conditions | [object] | List of field-based conditions. | | conditions | field [*required*] | string | The field to match on. | | conditions | values [*required*] | [string] | The values to match. | | attributes | created | date-time | Timestamp when the rule was created. | | attributes | created_by_uuid | uuid | UUID of the user who created the rule. | | attributes | deleted | date-time | Timestamp when the rule was deleted. | | attributes | enabled | boolean | Whether the rule is enabled. | | attributes | execution_type | int64 | The execution type of the rule. | | attributes | incident_settings_association_uuid | uuid | The incident settings association UUID. | | attributes | match_any_condition | boolean | Whether any condition should match. | | attributes | modified | date-time | Timestamp when the rule was last modified. | | attributes | modified_by_uuid | uuid | UUID of the user who last modified the rule. | | attributes | org_id | int64 | The organization ID. | | attributes | task_id | string | The task ID. | | attributes | task_payload | string | The JSON-encoded task payload. | | attributes | trigger | string | The trigger event for the rule. | | data | id [*required*] | uuid | The rule identifier. | | data | type [*required*] | enum | Incident rule response resource type. Allowed enum values: `incidents_rules` | {% /tab %} {% tab title="Example" %} ```json { "data": { "attributes": { "condition": { "normalized_query": "severity:SEV-1", "raw_query": "severity:SEV-1" }, "condition_table_type": 1, "conditions": [ { "field": "severity", "values": [ "SEV-1", "SEV-2" ] } ], "created": "2024-01-01T00:00:00.000Z", "created_by_uuid": "00000000-0000-0000-0000-000000000001", "deleted": null, "enabled": true, "execution_type": 1, "incident_settings_association_uuid": null, "match_any_condition": false, "modified": "2024-01-01T00:00:00.000Z", "modified_by_uuid": "00000000-0000-0000-0000-000000000001", "org_id": 123456, "task_id": "notify-incident-handles-job", "task_payload": "{}", "trigger": "incident_created_trigger" }, "id": "00000000-0000-0000-0000-000000000000", "type": "incidents_rules" } } ``` {% /tab %} {% /tab %} {% tab title="400" %} Bad Request {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="401" %} Unauthorized {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="403" %} Forbidden {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="429" %} Too many requests {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} ### Code Example ##### \## default # \# Curl command curl -X POST "https://api.datadoghq.com/api/v2/incidents/config/rules" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \ -d @- << EOF { "data": { "attributes": { "condition": { "raw_query": "severity:SEV-1" }, "condition_table_type": 1, "enabled": true, "execution_type": 1, "task_id": "notify-incident-handles-job", "task_payload": "{}", "trigger": "incident_created_trigger" }, "type": "incident_rules" } } EOF {% /tab %}