Rules

Secure rules define what a scan looks for. Each rule has a type (what it inspects), an action (block, flag, or log), a severity, and a scope (all agents, or specific ones). You can list, create, and update rules over the API.

List rules#

GET /v1/secure/rules — requires scope secure:rules:read.

curl "https://api.maetra.io/v1/secure/rules" \
  -H "Authorization: Bearer $MAETRA_API_KEY"

{
  "rules": [
    {
      "id": "rule_71c",
      "name": "Outbound PII",
      "description": "Flag customer PII leaving the system.",
      "type": "data_pattern",
      "action": "flag",
      "severity": "medium",
      "status": "active",
      "is_built_in": false,
      "applies_to_all": true,
      "trigger_count": 12,
      "last_triggered_at": "2026-07-06T22:04:00.000Z",
      "version": 3,
      "updated_at": "2026-07-01T09:12:00.000Z"
    }
  ]
}

See the rule object for every field.

Create a rule#

POST /v1/secure/rules — requires scope secure:rules:write. Returns 201.

Rule types

Request body

Note New rules default to status: draft — they don't affect scans until active. Create as draft, test, then promote (with Update a rule).

curl -X POST "https://api.maetra.io/v1/secure/rules" \
  -H "Authorization: Bearer $MAETRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Block secrets in tool calls",
  "type": "data_pattern",
  "action": "block",
  "severity": "high",
  "status": "active",
  "data_direction": "outbound",
  "custom_patterns": [
    "AKIA[0-9A-Z]{16}",
    "-----BEGIN (RSA )?PRIVATE KEY-----"
  ]
}'

{
  "rule": {
    "id": "rule_9f2",
    "name": "Block secrets in tool calls",
    "type": "data_pattern",
    "action": "block",
    "severity": "high",
    "status": "active",
    "is_built_in": false,
    "applies_to_all": true,
    "trigger_count": 0,
    "last_triggered_at": null,
    "version": 1,
    "updated_at": "2026-07-07T11:40:00.000Z"
  }
}

Update a rule#

PATCH /v1/secure/rules/{id} — requires scope secure:rules:write.

Only the fields you send are changed; omit the rest to leave them untouched. Accepts the same fields as create (all optional here). Built-in rules can't be edited. A common use is flipping a draft rule to active, or dialing an action from block down to flag:

curl -X PATCH "https://api.maetra.io/v1/secure/rules/rule_9f2" \
  -H "Authorization: Bearer $MAETRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "status": "active",
  "action": "flag"
}'

{
  "rule": {
    "id": "rule_9f2",
    "name": "Block secrets in tool calls",
    "action": "flag",
    "status": "active",
    "version": 2,
    "updated_at": "2026-07-07T12:02:00.000Z"
  }
}

Note List-type fields (custom_patterns, tool_names, agent_ids, …) are replaced when you send them — send the full desired list, not a delta. Omit a list entirely to leave it unchanged.

Rule object#