---
title: List incident rules
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > API Reference > Incidents
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# List incident rules{% #list-incident-rules %}
Copy pageCopied
{% tab title="v2" %}
**Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
| Datadog site      | API endpoint                                                    |
| ----------------- | --------------------------------------------------------------- |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/incidents/config/rules |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/incidents/config/rules |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/incidents/config/rules      |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/incidents/config/rules      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/incidents/config/rules  |
| uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/incidents/config/rules |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/incidents/config/rules     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/incidents/config/rules |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/incidents/config/rules |

### Overview

List all incident rules. This endpoint requires any of the following permissions:
`incident_settings_read``incident_notification_settings_read` 


OAuth apps require the `incident_settings_read` authorization [scope](https://docs.datadoghq.com/api/latest/scopes.md#incidents) to access this endpoint.



### Arguments

#### Query Strings

| Name             | Type   | Description                         |
| ---------------- | ------ | ----------------------------------- |
| filter[task_id]  | string | Filter rules by task ID.            |
| filter[trigger]  | string | Filter rules by trigger.            |
| incidentTypeUUID | string | Filter rules by incident type UUID. |

### Response

{% tab title="200" %}
OK
{% tab title="Model" %}
Response with a list of incident rules.

| Parent field | Field                              | Type      | Description                                                                  |
| ------------ | ---------------------------------- | --------- | ---------------------------------------------------------------------------- |
|              | data [*required*]             | [object]  | List of incident rules.                                                      |
| data         | attributes [*required*]       | object    | Attributes of an incident rule in a response.                                |
| attributes   | condition                          | object    | A query-based condition for an incident rule.                                |
| condition    | normalized_query                   | string    | The normalized query string.                                                 |
| condition    | raw_query                          | string    | The raw query string.                                                        |
| attributes   | condition_table_type               | int64     | The condition table type.                                                    |
| attributes   | conditions                         | [object]  | List of field-based conditions.                                              |
| conditions   | field [*required*]            | string    | The field to match on.                                                       |
| conditions   | values [*required*]           | [string]  | The values to match.                                                         |
| attributes   | created                            | date-time | Timestamp when the rule was created.                                         |
| attributes   | created_by_uuid                    | uuid      | UUID of the user who created the rule.                                       |
| attributes   | deleted                            | date-time | Timestamp when the rule was deleted.                                         |
| attributes   | enabled                            | boolean   | Whether the rule is enabled.                                                 |
| attributes   | execution_type                     | int64     | The execution type of the rule.                                              |
| attributes   | incident_settings_association_uuid | uuid      | The incident settings association UUID.                                      |
| attributes   | match_any_condition                | boolean   | Whether any condition should match.                                          |
| attributes   | modified                           | date-time | Timestamp when the rule was last modified.                                   |
| attributes   | modified_by_uuid                   | uuid      | UUID of the user who last modified the rule.                                 |
| attributes   | org_id                             | int64     | The organization ID.                                                         |
| attributes   | task_id                            | string    | The task ID.                                                                 |
| attributes   | task_payload                       | string    | The JSON-encoded task payload.                                               |
| attributes   | trigger                            | string    | The trigger event for the rule.                                              |
| data         | id [*required*]               | uuid      | The rule identifier.                                                         |
| data         | type [*required*]             | enum      | Incident rule response resource type. Allowed enum values: `incidents_rules` |

{% /tab %}

{% tab title="Example" %}

```json
{
  "data": [
    {
      "attributes": {
        "condition": {
          "normalized_query": "severity:SEV-1",
          "raw_query": "severity:SEV-1"
        },
        "condition_table_type": 1,
        "conditions": [
          {
            "field": "severity",
            "values": [
              "SEV-1",
              "SEV-2"
            ]
          }
        ],
        "created": "2024-01-01T00:00:00.000Z",
        "created_by_uuid": "00000000-0000-0000-0000-000000000001",
        "deleted": null,
        "enabled": true,
        "execution_type": 1,
        "incident_settings_association_uuid": null,
        "match_any_condition": false,
        "modified": "2024-01-01T00:00:00.000Z",
        "modified_by_uuid": "00000000-0000-0000-0000-000000000001",
        "org_id": 123456,
        "task_id": "notify-incident-handles-job",
        "task_payload": "{}",
        "trigger": "incident_created_trigger"
      },
      "id": "00000000-0000-0000-0000-000000000000",
      "type": "incidents_rules"
    }
  ]
}
```

{% /tab %}

{% /tab %}

{% tab title="400" %}
Bad Request
{% tab title="Model" %}
API error response.

| Field                    | Type     | Description       |
| ------------------------ | -------- | ----------------- |
| errors [*required*] | [string] | A list of errors. |

{% /tab %}

{% tab title="Example" %}

```json
{
  "errors": [
    "Bad Request"
  ]
}
```

{% /tab %}

{% /tab %}

{% tab title="401" %}
Unauthorized
{% tab title="Model" %}
API error response.

| Field                    | Type     | Description       |
| ------------------------ | -------- | ----------------- |
| errors [*required*] | [string] | A list of errors. |

{% /tab %}

{% tab title="Example" %}

```json
{
  "errors": [
    "Bad Request"
  ]
}
```

{% /tab %}

{% /tab %}

{% tab title="403" %}
Forbidden
{% tab title="Model" %}
API error response.

| Field                    | Type     | Description       |
| ------------------------ | -------- | ----------------- |
| errors [*required*] | [string] | A list of errors. |

{% /tab %}

{% tab title="Example" %}

```json
{
  "errors": [
    "Bad Request"
  ]
}
```

{% /tab %}

{% /tab %}

{% tab title="429" %}
Too many requests
{% tab title="Model" %}
API error response.

| Field                    | Type     | Description       |
| ------------------------ | -------- | ----------------- |
| errors [*required*] | [string] | A list of errors. |

{% /tab %}

{% tab title="Example" %}

```json
{
  "errors": [
    "Bad Request"
  ]
}
```

{% /tab %}

{% /tab %}

### Code Example

##### 
                  \# Curl command curl -X GET "https://api.datadoghq.com/api/v2/incidents/config/rules" \
-H "Accept: application/json" \
-H "DD-API-KEY: ${DD_API_KEY}" \
-H "DD-APPLICATION-KEY: ${DD_APP_KEY}" 
                
{% /tab %}