Skip to main content
POST
Preview enrichment rule results

Restrictions

Usage

  • Nothing is saved and no alert or event is created.
  • integration_id must be an integration of the account, and the caller must be allowed to read it.
  • A mapping rule with mapping_type = api calls the account’s mapping API with its stored headers, so the request also needs permission to edit the integration; without it the call fails.
  • before is the event as it arrived, after is the event after the rules; steps explains every rule — whether its conditions matched, why it was skipped, and which labels it added, removed or rewrote.
  • A firing event is rendered the way ingestion does after enrichment, so [TPL] labels, title and description in after are the final ones.
  • if keys must come from the alert or change event vocabulary (title, description, labels.<name>, …); other keys return InvalidParameter.

Authorizations

app_key
string
query
required

APP Key created in the Flashduty console under My → APP Key. Send it as the app_key query parameter or in the Fd-App-Key request header. Its effective access is the intersection of the key's permission scope and the creator's current role permissions. Keep it secret.

Body

application/json

Request body of POST /enrichment/preview.

integration_id
integer<int64>
required

Integration whose context the preview runs in. The rules you send are not saved.

Required range: x >= 1
event
object
required

The event to run the rules over.

rules
object[]

Enrichment rules to try, in order. At most 50. The integration's stored rules are not used.

Maximum array length: 50

Response

Success

Success response envelope. On every 2xx response, request_id identifies the call (also mirrored in the Flashcat-Request-Id header) and data holds the endpoint-specific payload. Failure responses use a different shape — see ErrorResponse.

request_id
string
required

Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues.

Example:

"01HK8XQE3Z7JM2NTFQ5YJ8P9R4"

data
object

Result of the enrichment preview.