> ## Documentation Index > Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt > Use this file to discover all available pages before exploring further. # List rules visible to the caller. > Human callers receive their personal rules, rules from the selected organisation (or each permitted organisation in personal context), and canonical platform-global rules. API keys receive rules owned by their immutable account plus canonical platform-global rules. ## OpenAPI ````yaml https://api.infrawatch.com/openapi.json?contract=d15375c get /rules openapi: 3.1.0 info: description: >- Customer-facing Infrawatch APIs. Authenticate with an API key unless an operation documents another supported credential. ### Infrawatch Public API Public API authenticated exclusively with Infrawatch API keys. ### Infrawatch Customer Alerting API Project alert rules, destinations, silences, inbox state, and delivery history. ### Infrawatch Remote Browser API Project-scoped interactive browser sessions owned by Platform Core. Session admission, lifecycle, RBAC, audit, usage, screenshot history, and stream tickets are Platform Core resources. The browser master is private infrastructure and its identifiers, proxy routes, process options, and credentials are never exposed by this API. A session and all of its evidence are private to the credential that created it. Project managers may list project session metadata, inspect one session's metadata, and terminate it, but cannot access its live stream, screenshots, or network events. Terminal session metadata and screenshots are retained indefinitely. A creator can replay a terminal session as a new queued resource while preserving a durable link to the source session. ### Infrawatch ESI API Customer-facing External Surface Intelligence API for project-scoped product data authenticated by an Infrawatch API key. API keys are constrained to their immutable owner's project ceiling and assigned ESI scopes; human project-manager fallback never expands an API key. Authorised API-key requests are rate-limited and consume monthly quota. ### Infrawatch Reports API Threat report discovery API authenticated by an Infrawatch API key. ### Infrawatch Public Rules API Account-aware rule authoring, taxonomy, catalogue, and runtime observations for API clients. ### Infrawatch Search API Search hosts, services, DNS records, and certificates. Complete percent-encoded query strings are limited to 65536 bytes. title: Infrawatch Customer API version: 1.0.0 servers: - description: Infrawatch customer API url: https://api.infrawatch.com/api/v1 security: [] tags: - name: API Usage - name: Projects - name: Alert destinations - name: Alert rules - name: Alert silences - name: Alerts - name: Browser sessions - name: Browser evidence - name: Browser streaming - name: Access - name: Inventory - name: Dangling DNS - name: Findings - name: Secrets - name: Typosquatting - name: Services - name: AI Surface - description: Search hosts, services, DNS records, certificates, and open directories. name: Search - name: Dashboard - name: Reports - name: Rules - name: Rule tags - name: Rule observations paths: /rules: servers: - url: https://api.infrawatch.com/api/v1 get: tags: - Rules summary: List rules visible to the caller. description: >- Human callers receive their personal rules, rules from the selected organisation (or each permitted organisation in personal context), and canonical platform-global rules. API keys receive rules owned by their immutable account plus canonical platform-global rules. operationId: listRules parameters: - $ref: '#/components/parameters/rules_v1_Query' - $ref: '#/components/parameters/rules_v1_Limit' - $ref: '#/components/parameters/rules_v1_Offset' - $ref: '#/components/parameters/rules_v1_RuleOwnership' - in: query name: status schema: enum: - enabled - disabled - invalid type: string - in: query name: admission schema: $ref: '#/components/schemas/rules_v1_RuleAdmissionState' - in: query name: category schema: items: $ref: '#/components/schemas/rules_v1_RuleCategorySlug' maxItems: 50 type: array - description: >- Return only rules carrying this tag. A tag has many rules, so this is the reverse lookup behind a tag's rule listing. The tag must itself be visible to the caller. in: query name: tag_uuid schema: format: uuid type: string responses: '200': content: application/json: schema: properties: pagination: $ref: '#/components/schemas/rules_v1_Pagination' rules: items: $ref: '#/components/schemas/rules_v1_RuleControlRule' type: array required: - rules - pagination type: object description: >- Personal, permitted organisation, and platform-global rules visible to the caller. '400': $ref: '#/components/responses/rules_v1_BadRequest' '403': $ref: '#/components/responses/rules_v1_Forbidden' security: - apiKeyAuth: [] components: parameters: rules_v1_Query: in: query name: q schema: maxLength: 200 type: string rules_v1_Limit: in: query name: limit schema: default: 50 maximum: 200 minimum: 1 type: integer rules_v1_Offset: in: query name: offset schema: default: 0 minimum: 0 type: integer rules_v1_RuleOwnership: description: >- Restrict results to rules owned by the caller's personal account or by a permitted organisation. Omit this filter to include both ownership types and canonical platform-global rules. in: query name: ownership required: false schema: enum: - personal - organisation type: string schemas: rules_v1_RuleAdmissionState: enum: - pending - approved - revoked type: string rules_v1_RuleCategorySlug: maxLength: 100 minLength: 1 pattern: ^[a-z0-9][a-z0-9-]{0,99}(/[a-z0-9][a-z0-9-]{0,99})*$ type: string rules_v1_Pagination: properties: has_more: description: True when another page is available. type: boolean limit: type: integer next_cursor: description: Opaque cursor for the next page when keyset pagination is available. type: string offset: type: integer total: format: int64 type: integer required: - limit - offset - total type: object rules_v1_RuleControlRule: properties: admission_state: $ref: '#/components/schemas/rules_v1_RuleAdmissionState' admitted_revision: format: int64 minimum: 1 type: integer category_slugs: items: $ref: '#/components/schemas/rules_v1_RuleCategorySlug' maxItems: 50 type: array uniqueItems: true classification: $ref: '#/components/schemas/rules_v1_RuleClassification' created_at: format: date-time type: string description: maxLength: 4000 type: string dns_takeover: $ref: '#/components/schemas/rules_v1_DNSTakeoverMetadata' editable: description: >- True only when the active account owns the rule and the caller currently has rules.manage. Visible personal, organisation, and global rules owned outside the active account are read-only. type: boolean enabled: type: boolean individual_account_uuid: format: uuid type: string input_kind: $ref: '#/components/schemas/rules_v1_RuleInputKind' internal_rule: type: boolean match_updated_at: format: date-time type: string name: maxLength: 200 type: string organisation_uuid: format: uuid type: string public: type: boolean revision: format: int64 minimum: 1 type: integer source: description: >- Original authored rule source. Prepared execution source is never exposed. maxLength: 1048576 type: string tag_names: description: >- Tag names aligned with tag_uuids. An unavailable tag is represented by an empty string. items: type: string type: array tag_uuids: description: >- References in rule order. A UUID is retained when a formerly visible foreign tag becomes private so the reference can still be removed. items: format: uuid type: string maxItems: 100 type: array uniqueItems: true tags: description: >- Tag slugs aligned with tag_uuids. An unavailable tag is represented by an empty string. items: type: string type: array updated_at: format: date-time type: string uuid: format: uuid type: string validated_at: format: date-time type: string validation_error: maxLength: 4000 type: string validation_status: $ref: '#/components/schemas/rules_v1_RuleValidationStatus' required: - uuid - name - description - source - input_kind - classification - category_slugs - tag_uuids - tags - tag_names - enabled - public - internal_rule - editable - validation_status - admission_state - revision - match_updated_at - created_at - updated_at type: object rules_v1_RuleClassification: enum: - benign - suspicious - malicious type: string rules_v1_DNSTakeoverMetadata: properties: claim_mode: type: string confidence: type: string enabled: type: boolean http_probe: $ref: '#/components/schemas/rules_v1_DNSHTTPProbe' matcher_id: type: string needs_domain_availability: type: boolean provider: type: string record_types: items: type: string type: array references: items: type: string type: array rule_id: type: string service: type: string status: type: string required: - enabled type: object rules_v1_RuleInputKind: enum: - scan_result - certificate_event type: string rules_v1_RuleValidationStatus: enum: - pending - valid - invalid type: string rules_v1_DNSHTTPProbe: properties: allow_network_errors: type: boolean follow_redirects: type: boolean path: type: string schemes: items: type: string type: array required: - follow_redirects - allow_network_errors type: object responses: rules_v1_BadRequest: description: Invalid request. rules_v1_Forbidden: description: Permission denied. securitySchemes: apiKeyAuth: description: >- Infrawatch API key. Supply the complete key directly as the header value. in: header name: X-API-Key type: apiKey ````