> ## Documentation Index > Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt > Use this file to discover all available pages before exploring further. # Reorder escalation rules > Change the evaluation order of a channel's escalation rules by moving one rule into another rule's slot. ## Restrictions | Aspect | Value | | - | - | | Rate limits | **300 requests/minute**; **20 requests/second** per account | | Permissions | **Channels Manage** (`on-call`) | ## Usage * Rules are evaluated in ascending `priority`: the first enabled rule whose `time_filters` and `filters` match a new incident takes it, and later rules are skipped. This endpoint moves `drag_rule_id` into `target_rule_id`'s slot and renumbers the channel's rules from priority 0, changing that evaluation order. * Both `drag_rule_id` and `target_rule_id` must be rules of `channel_id`; otherwise `InvalidParameter`. * An unknown `channel_id` returns `InvalidParameter`. * Concurrent reorders of the same channel are rejected with `TooManyRequests`. * The caller must also be able to edit the channel: the account owner or an admin, the channel creator, or a member of its managing teams (of its owning team when `managing_team_ids` is empty). Otherwise the call returns `AccessDenied`. * Every call is recorded in the account audit log. ## OpenAPI ````yaml /api-reference/on-call.openapi.en.json post /channel/escalate/rule/reorder openapi: 3.1.0 info: title: Flashduty Open API description: >- Public HTTP API for the Flashduty incident management platform — incidents, notification templates, channels, schedules, monitors, RUM, and platform administration. Every operation is authenticated with an `app_key` query parameter created in the Flashduty console under My → APP Key (or sent in the `Fd-App-Key` header). Responses follow a uniform envelope: `{ request_id, data }` on success, `{ request_id, error }` on failure. version: 1.0.0 servers: - url: https://api.flashcat.cloud description: Flashduty Open API security: - AppKeyAuth: [] tags: - name: On-call/Incidents description: '' - name: On-call/Channels description: '' - name: On-call/Alerts description: >- Search, inspect, and act on alerts. Manage card views and alert processing pipelines. - name: On-call/Integrations description: '' - name: On-call/IM integrations description: IM integration queries, such as which integrations have war room enabled. - name: On-call/Schedules description: '' - name: On-call/Licenses description: '' - name: On-call/Calendars description: '' - name: On-call/Notification templates description: '' - name: On-call/Alert enrichment description: Custom fields, enrichment rules, and data mapping (schema, data, API). - name: On-call/Analytics description: '' - name: On-call/Status pages description: '' - name: On-call/Changes description: '' paths: /channel/escalate/rule/reorder: post: tags: - On-call/Channels summary: Reorder escalation rules description: >- Change the evaluation order of a channel's escalation rules by moving one rule into another rule's slot. operationId: channelEscalateRuleReorder requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ReorderEscalationRulesRequest' responses: '200': description: Success content: application/json: schema: allOf: - $ref: '#/components/schemas/SuccessEnvelope' - type: object properties: data: type: object example: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: {} '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/ServerError' components: schemas: ReorderEscalationRulesRequest: type: object required: - channel_id - drag_rule_id - target_rule_id properties: channel_id: type: integer format: int64 description: Owning channel ID; obtain it from `POST /channel/list`. drag_rule_id: type: string pattern: ^[0-9a-fA-F]{24}$ description: >- ID of the rule being dragged (24-character hex), as returned in `rule_id` by the create or list endpoint. target_rule_id: type: string pattern: ^[0-9a-fA-F]{24}$ description: >- ID of the rule whose slot the dragged rule moves into (24-character hex). SuccessEnvelope: type: object description: >- Success response envelope. On every 2xx response, `request_id` identifies the call (also mirrored in the `Flashcat-Request-Id` header) and `data` holds the endpoint-specific payload. Failure responses use a different shape — see `ErrorResponse`. properties: request_id: type: string description: >- Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues. example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: description: >- Operation-specific payload, documented in each operation's 200 response. Operations without a payload return `{}` or omit `data` entirely. required: - request_id ErrorResponse: type: object description: Response envelope for errors. `error` is required; `data` is absent. properties: request_id: type: string example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 description: >- Unique trace ID of this request; include it when reporting issues so logs can be located. error: $ref: '#/components/schemas/DutyError' required: - request_id - error DutyError: type: object description: >- Error payload inside the response envelope. Present only on non-2xx responses. properties: code: $ref: '#/components/schemas/ErrorCode' message: type: string description: >- Human-readable error message in the response language (`locale` / `lang` query parameter or `Accept-Language` header). May name the offending field; do not parse it. example: The specified parameter template_id is not valid. required: - code - message ErrorCode: type: string description: >- Error code. Every failed response sets `error.code` to one of these stable strings; branch on it rather than on the HTTP status. | Code | HTTP | Meaning | |---|---|---| | `OK` | 200 | Reserved; never returned on a failed request. | | `InvalidParameter` | 400 | A parameter is missing, has the wrong type, or failed validation; `message` usually names the field. | | `BadRequest` | 400 | The request breaks a business rule or conflicts with the current state of an object; `message` says which. | | `InvalidContentType` | 400 | The body is not sent as `application/json`. | | `ResourceNotFound` | 400 | The referenced object does not exist in this account or was deleted. Returned as HTTP 400, not 404. | | `NoLicense` | 400 | The account's plan does not include the feature, a plan quota is used up, the plan has expired, or credits are insufficient. | | `ReferenceExist` | 400 | The object is still referenced by other objects, so it cannot be deleted. | | `Unauthorized` | 401 | The APP Key is missing, invalid, or deleted. | | `BalanceNotEnough` | 402 | Console-only (billing); not returned by Open API operations. | | `AccessDenied` | 403 | The APP Key's permission scope or the creator's role does not allow this operation or object. | | `RouteNotFound` | 404 | No operation matches the HTTP method and path. | | `MethodNotAllowed` | 405 | The path exists but not for this HTTP method. | | `UndonedOrderExist` | 409 | Console-only (billing); not returned by Open API operations. | | `EntityTooLarge` | 413 | The request body exceeds the size limit. | | `RequestLocked` | 423 | Console-only (sign-in protection); not returned by Open API operations. | | `RequestVerifyRequired` | 428 | Console-only (verification code); not returned by Open API operations. | | `DangerousOperation` | 428 | Console-only (MFA for high-risk actions); not returned by Open API operations. | | `RequestTooFrequently` | 429 | A rate limit was hit; wait for the `Flashcat-Request-Rate-Limit-Delay` response header (seconds) before retrying. | | `InternalError` | 500 | Unexpected server error; retry with backoff and include `request_id` when reporting. | | `ServiceUnavailable` | 503 | A backend dependency is overloaded or unavailable; retry with backoff. | enum: - OK - InvalidParameter - BadRequest - InvalidContentType - ResourceNotFound - NoLicense - ReferenceExist - Unauthorized - BalanceNotEnough - AccessDenied - RouteNotFound - MethodNotAllowed - UndonedOrderExist - EntityTooLarge - RequestLocked - RequestVerifyRequired - DangerousOperation - RequestTooFrequently - InternalError - ServiceUnavailable x-enumDescriptions: OK: Reserved; never returned on a failed request. InvalidParameter: >- A parameter is missing, has the wrong type, or failed validation; `message` usually names the field. BadRequest: >- The request breaks a business rule or conflicts with the current state of an object; `message` says which. InvalidContentType: The body is not sent as `application/json`. ResourceNotFound: >- The referenced object does not exist in this account or was deleted. Returned as HTTP 400, not 404. NoLicense: >- The account's plan does not include the feature, a plan quota is used up, the plan has expired, or credits are insufficient. ReferenceExist: >- The object is still referenced by other objects, so it cannot be deleted. Unauthorized: The APP Key is missing, invalid, or deleted. BalanceNotEnough: Console-only (billing); not returned by Open API operations. AccessDenied: >- The APP Key's permission scope or the creator's role does not allow this operation or object. RouteNotFound: No operation matches the HTTP method and path. MethodNotAllowed: The path exists but not for this HTTP method. UndonedOrderExist: Console-only (billing); not returned by Open API operations. EntityTooLarge: The request body exceeds the size limit. RequestLocked: >- Console-only (sign-in protection); not returned by Open API operations. RequestVerifyRequired: Console-only (verification code); not returned by Open API operations. DangerousOperation: >- Console-only (MFA for high-risk actions); not returned by Open API operations. RequestTooFrequently: >- A rate limit was hit; wait for the `Flashcat-Request-Rate-Limit-Delay` response header (seconds) before retrying. InternalError: >- Unexpected server error; retry with backoff and include `request_id` when reporting. ServiceUnavailable: A backend dependency is overloaded or unavailable; retry with backoff. example: InvalidParameter responses: BadRequest: description: Invalid request — usually a missing or malformed parameter. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingParameter: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: InvalidParameter message: The specified parameter is not valid. Unauthorized: description: Missing or invalid app_key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingAppKey: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: Unauthorized message: You are unauthorized. Forbidden: description: >- The app_key is valid, but its permission scope or the creator's role does not allow this operation or object. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: noEditPermission: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: AccessDenied message: Access Denied. TooManyRequests: description: >- Rate limit hit. Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: rateLimited: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: RequestTooFrequently message: Request too frequently. headers: Flashcat-Request-Rate-Limit-Delay: description: >- Seconds until the current rate-limit window resets. Absent when the request was rejected by the gateway's global protection limit. schema: type: integer minimum: 0 ServerError: description: Unexpected server-side error. Include the request_id when reporting. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: InternalError message: >- We encountered an internal error, and it has been reported. Please try again later. securitySchemes: AppKeyAuth: type: apiKey in: query name: app_key description: >- APP Key created in the Flashduty console under My → APP Key. Send it as the `app_key` query parameter or in the `Fd-App-Key` request header. Its effective access is the intersection of the key's permission scope and the creator's current role permissions. Keep it secret. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.