--- title: Create a ticket creation rule description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > API Reference > Security Monitoring --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Create a ticket creation rule{% #create-a-ticket-creation-rule %} Copy pageCopied {% tab title="v2" %} **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). | Datadog site | API endpoint | | ----------------- | -------------------------------------------------------------------------------------------- | | ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/security/findings/automation/ticket_creation_rules | | ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/security/findings/automation/ticket_creation_rules | | app.datadoghq.eu | POST https://api.datadoghq.eu/api/v2/security/findings/automation/ticket_creation_rules | | app.ddog-gov.com | POST https://api.ddog-gov.com/api/v2/security/findings/automation/ticket_creation_rules | | us2.ddog-gov.com | POST https://api.us2.ddog-gov.com/api/v2/security/findings/automation/ticket_creation_rules | | uk1.datadoghq.com | POST https://api.uk1.datadoghq.com/api/v2/security/findings/automation/ticket_creation_rules | | app.datadoghq.com | POST https://api.datadoghq.com/api/v2/security/findings/automation/ticket_creation_rules | | us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/security/findings/automation/ticket_creation_rules | | us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/security/findings/automation/ticket_creation_rules | ### Overview Create a new ticket creation rule for the current organization. This endpoint requires the `security_pipelines_write` permission. ### Request #### Body Data (required) {% tab title="Model" %} | Parent field | Field | Type | Description | | ------------ | ------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | object | The data object for a ticket creation rule create or update request. | | data | attributes [*required*] | object | Attributes for creating or updating a ticket creation rule. | | attributes | action [*required*] | object | The action to take when the ticket creation rule matches a finding. | | action | assignee_id | uuid | The UUID of the default assignee for created tickets. | | action | fields | object | Custom fields of the Jira issue to create. For the list of available fields, see [Jira documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v2/api-group-issues/#api-rest-api-2-issue-createmeta-projectidorkey-issuetypes-issuetypeid-get). | | action | max_tickets_per_day [*required*] | int64 | The maximum number of tickets the rule may create per day. If exceeded, one final ticket will be created, explaining the limit was hit and link back to the responsible rule. | | action | project_id [*required*] | uuid | The UUID of the case management project. | | action | target [*required*] | enum | The ticketing system to create tickets in. Allowed enum values: `jira,case_management` | | attributes | enabled | boolean | Whether the ticket creation rule is enabled. | | attributes | name [*required*] | string | The name of the ticket creation rule. | | attributes | rule [*required*] | object | Defines the scope of findings to which the automation rule applies. | | rule | finding_types [*required*] | [string] | The list of security finding types that the automation rule applies to. | | rule | query | string | A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema.md). | | data | type [*required*] | enum | The JSON:API type for ticket creation rules. Allowed enum values: `ticket_creation_rules` | {% /tab %} {% tab title="Example" %} ```json { "data": { "attributes": { "action": { "max_tickets_per_day": 10, "project_id": "11111111-1111-1111-1111-111111111111", "target": "jira" }, "enabled": true, "name": "Example-Security-Monitoring", "rule": { "finding_types": [ "misconfiguration" ], "query": "env:staging" } }, "type": "ticket_creation_rules" } } ``` {% /tab %} ### Response {% tab title="201" %} Successfully created the ticket creation rule {% tab title="Model" %} A single ticket creation rule response. | Parent field | Field | Type | Description | | ------------ | ------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | object | The data object for a ticket creation rule returned by the API. | | data | attributes [*required*] | object | Attributes of a ticket creation rule returned by the API. | | attributes | action [*required*] | object | The action to take when the ticket creation rule matches a finding. | | action | assignee_id | uuid | The UUID of the default assignee for created tickets. | | action | auto_disabled_reason | string | The reason the rule was automatically disabled by the system due to a ticketing integration error. | | action | fields | object | Custom fields of the Jira issue to create. For the list of available fields, see [Jira documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v2/api-group-issues/#api-rest-api-2-issue-createmeta-projectidorkey-issuetypes-issuetypeid-get). | | action | max_tickets_per_day [*required*] | int64 | The maximum number of tickets the rule may create per day. If exceeded, one final ticket will be created, explaining the limit was hit and link back to the responsible rule. | | action | project_id [*required*] | uuid | The UUID of the case management project. | | action | target [*required*] | enum | The ticketing system to create tickets in. Allowed enum values: `jira,case_management` | | attributes | created_at [*required*] | int64 | The Unix timestamp in milliseconds when the rule was created. | | attributes | created_by [*required*] | object | The user or Datadog system who created the rule. | | created_by | id [*required*] | string | The actor's identifier (a user UUID or a system identifier). | | created_by | name [*required*] | string | The name of the actor. | | created_by | type [*required*] | enum | Whether the actor is a user or the Datadog system. Allowed enum values: `user,system` | | attributes | enabled [*required*] | boolean | Whether the ticket creation rule is enabled. | | attributes | modified_at [*required*] | int64 | The Unix timestamp in milliseconds when the rule was last modified. | | attributes | modified_by [*required*] | object | The user or Datadog system who last modified the rule. | | modified_by | id [*required*] | string | The actor's identifier (a user UUID or a system identifier). | | modified_by | name [*required*] | string | The name of the actor. | | modified_by | type [*required*] | enum | Whether the actor is a user or the Datadog system. Allowed enum values: `user,system` | | attributes | name [*required*] | string | The name of the ticket creation rule. | | attributes | rule [*required*] | object | Defines the scope of findings to which the automation rule applies. | | rule | finding_types [*required*] | [string] | The list of security finding types that the automation rule applies to. | | rule | query | string | A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema.md). | | data | id [*required*] | uuid | The ID of the ticket creation rule. | | data | type [*required*] | enum | The JSON:API type for ticket creation rules. Allowed enum values: `ticket_creation_rules` | {% /tab %} {% tab title="Example" %} ```json { "data": { "attributes": { "action": { "assignee_id": "22222222-2222-2222-2222-222222222222", "auto_disabled_reason": "Daily ticket creation limit exceeded", "fields": { "labels": [ "security" ] }, "max_tickets_per_day": 100, "project_id": "11111111-1111-1111-1111-111111111111", "target": "jira" }, "created_at": 1722439510282, "created_by": { "id": "00000000-0000-0000-0000-000000000000", "name": "Jane Doe", "type": "user" }, "enabled": true, "modified_at": 1722439510282, "modified_by": { "id": "00000000-0000-0000-0000-000000000000", "name": "Jane Doe", "type": "user" }, "name": "Auto-create Jira tickets for critical findings", "rule": { "finding_types": [ "misconfiguration" ], "query": "env:prod team:platform" } }, "id": "00000000-0000-0000-0000-000000000000", "type": "ticket_creation_rules" } } ``` {% /tab %} {% /tab %} {% tab title="400" %} Bad Request {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="403" %} Forbidden {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} {% tab title="422" %} Unprocessable Entity {% tab title="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------------ | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tab %} {% tab title="429" %} Too many requests {% tab title="Model" %} API error response. | Field | Type | Description | | ------------------------ | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab title="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tab %} ### Code Example ##### \## default # \# Curl command curl -X POST "https://api.datadoghq.com/api/v2/security/findings/automation/ticket_creation_rules" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \ -d @- << EOF { "data": { "attributes": { "action": { "max_tickets_per_day": 100, "project_id": "11111111-1111-1111-1111-111111111111", "target": "jira" }, "enabled": true, "name": "Auto-create Jira tickets for critical findings", "rule": { "finding_types": [ "misconfiguration" ], "query": "env:prod" } }, "type": "ticket_creation_rules" } } EOF ##### ```go // Create a ticket creation rule returns "Successfully created the ticket creation rule" response package main import ( "context" "encoding/json" "fmt" "os" "github.com/DataDog/datadog-api-client-go/v2/api/datadog" "github.com/DataDog/datadog-api-client-go/v2/api/datadogV2" "github.com/google/uuid" ) func main() { body := datadogV2.TicketCreationRuleCreateRequest{ Data: datadogV2.TicketCreationRuleDataCreate{ Attributes: datadogV2.TicketCreationRuleAttributesCreate{ Action: datadogV2.TicketCreationRuleAction{ MaxTicketsPerDay: 10, ProjectId: uuid.MustParse("11111111-1111-1111-1111-111111111111"), Target: datadogV2.TICKETCREATIONTARGET_JIRA, }, Enabled: datadog.PtrBool(true), Name: "Example-Security-Monitoring", Rule: datadogV2.AutomationRuleScope{ FindingTypes: []datadogV2.SecurityFindingType{ datadogV2.SECURITYFINDINGTYPE_MISCONFIGURATION, }, Query: datadog.PtrString("env:staging"), }, }, Type: datadogV2.TICKETCREATIONRULETYPE_TICKET_CREATION_RULES, }, } ctx := datadog.NewDefaultContext(context.Background()) configuration := datadog.NewConfiguration() configuration.SetUnstableOperationEnabled("v2.CreateSecurityFindingsAutomationTicketCreationRule", true) apiClient := datadog.NewAPIClient(configuration) api := datadogV2.NewSecurityMonitoringApi(apiClient) resp, r, err := api.CreateSecurityFindingsAutomationTicketCreationRule(ctx, body) if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.CreateSecurityFindingsAutomationTicketCreationRule`: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } responseContent, _ := json.MarshalIndent(resp, "", " ") fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.CreateSecurityFindingsAutomationTicketCreationRule`:\n%s\n", responseContent) } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=go) and then save the example to `main.go` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" go run "main.go" ##### ```java // Create a ticket creation rule returns "Successfully created the ticket creation rule" response import com.datadog.api.client.ApiClient; import com.datadog.api.client.ApiException; import com.datadog.api.client.v2.api.SecurityMonitoringApi; import com.datadog.api.client.v2.model.AutomationRuleScope; import com.datadog.api.client.v2.model.SecurityFindingType; import com.datadog.api.client.v2.model.TicketCreationRuleAction; import com.datadog.api.client.v2.model.TicketCreationRuleAttributesCreate; import com.datadog.api.client.v2.model.TicketCreationRuleCreateRequest; import com.datadog.api.client.v2.model.TicketCreationRuleDataCreate; import com.datadog.api.client.v2.model.TicketCreationRuleResponse; import com.datadog.api.client.v2.model.TicketCreationRuleType; import com.datadog.api.client.v2.model.TicketCreationTarget; import java.util.Collections; import java.util.UUID; public class Example { public static void main(String[] args) { ApiClient defaultClient = ApiClient.getDefaultApiClient(); defaultClient.setUnstableOperationEnabled( "v2.createSecurityFindingsAutomationTicketCreationRule", true); SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient); TicketCreationRuleCreateRequest body = new TicketCreationRuleCreateRequest() .data( new TicketCreationRuleDataCreate() .attributes( new TicketCreationRuleAttributesCreate() .action( new TicketCreationRuleAction() .maxTicketsPerDay(10L) .projectId( UUID.fromString("11111111-1111-1111-1111-111111111111")) .target(TicketCreationTarget.JIRA)) .enabled(true) .name("Example-Security-Monitoring") .rule( new AutomationRuleScope() .findingTypes( Collections.singletonList( SecurityFindingType.MISCONFIGURATION)) .query("env:staging"))) .type(TicketCreationRuleType.TICKET_CREATION_RULES)); try { TicketCreationRuleResponse result = apiInstance.createSecurityFindingsAutomationTicketCreationRule(body); System.out.println(result); } catch (ApiException e) { System.err.println( "Exception when calling" + " SecurityMonitoringApi#createSecurityFindingsAutomationTicketCreationRule"); System.err.println("Status code: " + e.getCode()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=java) and then save the example to `Example.java` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" java "Example.java" ##### ```python """ Create a ticket creation rule returns "Successfully created the ticket creation rule" response """ from datadog_api_client import ApiClient, Configuration from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi from datadog_api_client.v2.model.automation_rule_scope import AutomationRuleScope from datadog_api_client.v2.model.security_finding_type import SecurityFindingType from datadog_api_client.v2.model.ticket_creation_rule_action import TicketCreationRuleAction from datadog_api_client.v2.model.ticket_creation_rule_attributes_create import TicketCreationRuleAttributesCreate from datadog_api_client.v2.model.ticket_creation_rule_create_request import TicketCreationRuleCreateRequest from datadog_api_client.v2.model.ticket_creation_rule_data_create import TicketCreationRuleDataCreate from datadog_api_client.v2.model.ticket_creation_rule_type import TicketCreationRuleType from datadog_api_client.v2.model.ticket_creation_target import TicketCreationTarget from uuid import UUID body = TicketCreationRuleCreateRequest( data=TicketCreationRuleDataCreate( attributes=TicketCreationRuleAttributesCreate( action=TicketCreationRuleAction( max_tickets_per_day=10, project_id=UUID("11111111-1111-1111-1111-111111111111"), target=TicketCreationTarget.JIRA, ), enabled=True, name="Example-Security-Monitoring", rule=AutomationRuleScope( finding_types=[ SecurityFindingType.MISCONFIGURATION, ], query="env:staging", ), ), type=TicketCreationRuleType.TICKET_CREATION_RULES, ), ) configuration = Configuration() configuration.unstable_operations["create_security_findings_automation_ticket_creation_rule"] = True with ApiClient(configuration) as api_client: api_instance = SecurityMonitoringApi(api_client) response = api_instance.create_security_findings_automation_ticket_creation_rule(body=body) print(response) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=python) and then save the example to `example.py` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" python3 "example.py" ##### ```ruby # Create a ticket creation rule returns "Successfully created the ticket creation rule" response require "datadog_api_client" DatadogAPIClient.configure do |config| config.unstable_operations["v2.create_security_findings_automation_ticket_creation_rule".to_sym] = true end api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new body = DatadogAPIClient::V2::TicketCreationRuleCreateRequest.new({ data: DatadogAPIClient::V2::TicketCreationRuleDataCreate.new({ attributes: DatadogAPIClient::V2::TicketCreationRuleAttributesCreate.new({ action: DatadogAPIClient::V2::TicketCreationRuleAction.new({ max_tickets_per_day: 10, project_id: "11111111-1111-1111-1111-111111111111", target: DatadogAPIClient::V2::TicketCreationTarget::JIRA, }), enabled: true, name: "Example-Security-Monitoring", rule: DatadogAPIClient::V2::AutomationRuleScope.new({ finding_types: [ DatadogAPIClient::V2::SecurityFindingType::MISCONFIGURATION, ], query: "env:staging", }), }), type: DatadogAPIClient::V2::TicketCreationRuleType::TICKET_CREATION_RULES, }), }) p api_instance.create_security_findings_automation_ticket_creation_rule(body) ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=ruby) and then save the example to `example.rb` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" rb "example.rb" ##### ```rust // Create a ticket creation rule returns "Successfully created the ticket creation // rule" response use datadog_api_client::datadog; use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI; use datadog_api_client::datadogV2::model::AutomationRuleScope; use datadog_api_client::datadogV2::model::SecurityFindingType; use datadog_api_client::datadogV2::model::TicketCreationRuleAction; use datadog_api_client::datadogV2::model::TicketCreationRuleAttributesCreate; use datadog_api_client::datadogV2::model::TicketCreationRuleCreateRequest; use datadog_api_client::datadogV2::model::TicketCreationRuleDataCreate; use datadog_api_client::datadogV2::model::TicketCreationRuleType; use datadog_api_client::datadogV2::model::TicketCreationTarget; use uuid::Uuid; #[tokio::main] async fn main() { let body = TicketCreationRuleCreateRequest::new(TicketCreationRuleDataCreate::new( TicketCreationRuleAttributesCreate::new( TicketCreationRuleAction::new( 10, Uuid::parse_str("11111111-1111-1111-1111-111111111111").expect("invalid UUID"), TicketCreationTarget::JIRA, ), "Example-Security-Monitoring".to_string(), AutomationRuleScope::new(vec![SecurityFindingType::MISCONFIGURATION]) .query("env:staging".to_string()), ) .enabled(true), TicketCreationRuleType::TICKET_CREATION_RULES, )); let mut configuration = datadog::Configuration::new(); configuration.set_unstable_operation_enabled( "v2.CreateSecurityFindingsAutomationTicketCreationRule", true, ); let api = SecurityMonitoringAPI::with_config(configuration); let resp = api .create_security_findings_automation_ticket_creation_rule(body) .await; if let Ok(value) = resp { println!("{:#?}", value); } else { println!("{:#?}", resp.unwrap_err()); } } ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=rust) and then save the example to `src/main.rs` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" cargo run ##### ```typescript /** * Create a ticket creation rule returns "Successfully created the ticket creation rule" response */ import { client, v2 } from "@datadog/datadog-api-client"; const configuration = client.createConfiguration(); configuration.unstableOperations[ "v2.createSecurityFindingsAutomationTicketCreationRule" ] = true; const apiInstance = new v2.SecurityMonitoringApi(configuration); const params: v2.SecurityMonitoringApiCreateSecurityFindingsAutomationTicketCreationRuleRequest = { body: { data: { attributes: { action: { maxTicketsPerDay: 10, projectId: "11111111-1111-1111-1111-111111111111", target: "jira", }, enabled: true, name: "Example-Security-Monitoring", rule: { findingTypes: ["misconfiguration"], query: "env:staging", }, }, type: "ticket_creation_rules", }, }, }; apiInstance .createSecurityFindingsAutomationTicketCreationRule(params) .then((data: v2.TicketCreationRuleResponse) => { console.log( "API called successfully. Returned data: " + JSON.stringify(data) ); }) .catch((error: any) => console.error(error)); ``` #### Instructions First [install the library and its dependencies](https://docs.datadoghq.com/api/latest.md?code-lang=typescript) and then save the example to `example.ts` and run following commands: DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" tsc "example.ts" {% /tab %}